Bitcoin Core 24.0.1 and below have a high-risk vulnerability that affects 17% of full nodes

BlockBeats news, September 20, according to Protos, Bitcoin Core developers issued a new high-risk warning, saying that one in six Bitcoin nodes has a software vulnerability. On Thursday, staff of the open source Bitcoin Core project, which is responsible for maintaining software running on more than 98% of reachable full nodes, disclosed that there are major security issues with the software running on 17% of the network's nodes. Specifically, all software below Bitcoin Core version 24.0.1 is at risk. According to Bitnodes' monitoring estimates, this denial of service vulnerability affects approximately 3,330 of the 19,200 self-proclaimed user agents of accessible Bitcoin full nodes.

In Bitcoin Core software prior to version 24.0.1, malicious actors can use low-difficulty header chains to spam nodes. By forcing nodes to download and store extremely long header chains, attacks can crash nodes by taking up too much bandwidth or device storage space. The developers fixed this vulnerability in Bitcoin Core pull request (PR) number 25717 and merged it into production with the release of v24.0.1 on December 12, 2022. The current Bitcoin Core node software version (now 27.1) contains fixes for this and other vulnerabilities.

While this vulnerability is quite serious, there are few known attacks that exploit it in the public record. Since the cost of generating and broadcasting a block header chain to perform a denial of service attack is quite high, this vulnerability has little financial benefit to the attacker.