VulnSocial
← Back to blog

CVE-2018-17144 – High Remote DoS in Bitcoin Core & Bitcoin Knots

Key takeaways

  • Severity: High (CVSS 3.1 7.5) – remote denial‑of‑service.
  • Impact: Application crash (availability) for Bitcoin Core 0.14‑0.16 and Bitcoin Knots 0.14‑0.16.
  • Who is affected: Nodes running vulnerable versions; miners can trigger the crash with crafted duplicate inputs.
  • Action: Upgrade to Bitcoin Core v0.16.3 (or later) or Bitcoin Knots v0.16.3; monitor for crash logs and duplicate‑input patterns.
  • Threat intel: No public PoC; isolated claims of active exploitation, but no confirmed incidents.

Overview

CVE-2018-17144 is a remote denial‑of‑service vulnerability discovered on 17 September 2018 in the Bitcoin Core and Bitcoin Knots implementations. The flaw allows an attacker—particularly a miner— to crash a full node by submitting a transaction that contains a duplicate input. The bug resides in the transaction validation logic and can trigger an assertion failure or out‑of‑bounds memory access, forcing the client to abort.

The issue was responsibly disclosed by a Bitcoin Cash developer, and patches were released the next day (v0.16.3). For the full timeline and live signal data, see the VulnSocial CVE page: https://vulnsocial.com/cve/CVE-2018-17144.

Technical Details

  • Root cause: The transaction validation code failed to detect duplicate inputs before processing them. When a crafted transaction with the same UTXO referenced twice is validated, the node hits an internal consistency check that aborts the process.
  • Attack vector: Network‑remote. Any peer can broadcast the malicious transaction; no authentication or privileges are required (AV:N, PR:N).
  • Complexity: Low (AC:L). The attacker only needs to construct a transaction with duplicated inputs.
  • Impact: Availability (A:H). The node crashes, leading to a denial of service for the targeted peer. No confidentiality or integrity impact (C:N, I:N).
  • CVSS v3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (score 7.5).

Severity & Impact

CVE IDCVSSSeverityAffected Products
CVE-2018-171447.5 (v3.1)HighBitcoin Core, Bitcoin Knots

The vulnerability is classified High due to the guaranteed availability loss when exploited. While the bug does not affect transaction validity or funds, a large‑scale crash could disrupt network stability, especially for mining pools or services relying on a single node.

Affected Products

  • Bitcoin Core: versions 0.14.x < 0.14.3, 0.15.x < 0.15.2, 0.16.x < 0.16.3
  • Bitcoin Knots: versions 0.14.x through 0.16.x < 0.16.3

For the complete list of affected versions and CPE identifiers, see the CVE page: https://vulnsocial.com/cve/CVE-2018-17144.

Actionable Insights

  1. Immediate patch – Deploy Bitcoin Core v0.16.3 (or later) or Bitcoin Knots v0.16.3. These releases contain the fix for duplicate‑input handling.
  2. Version verification – Run bitcoind --version on all nodes and confirm the version string is at least 0.16.3.
  3. Log monitoring – Watch debug.log for entries such as ASSERTION FAILED or Segmentation fault that indicate the crash condition. Set up alerts for sudden node restarts.
  4. Network traffic inspection – Use a packet capture or a monitoring node to flag transactions with identical prevout references. While benign duplicate inputs are rare, a sudden surge may indicate exploitation attempts.
  5. Redundancy – Operate multiple full nodes behind a load balancer or use a fallback node to maintain service continuity if a single instance crashes.
  6. Threat intel tracking – No public PoC has been released, but social media chatter (e.g., claims of “active exploitation” on 2026‑06‑03) suggests interest. Regularly review the VulnSocial timeline for any new exploit indicators.

Remediation & Mitigation

  1. Upgrade to the patched releases:
    • Bitcoin Core v0.16.3 (or newer)
    • Bitcoin Knots v0.16.3 (or newer)
  2. Validate the upgrade by restarting the node and confirming the version output.
  3. Apply configuration hardening:
    • Set maxmempool and maxorphantx limits to reduce the impact of malformed transactions.
    • Enable -disablewallet on nodes that do not need wallet functionality to reduce attack surface.
  4. Implement health checks – Use a monitoring system (e.g., Prometheus + node exporter) to detect node downtime within seconds.
  5. Maintain a backup node – Keep a secondary node on a different host or cloud region, synchronized with the primary, to take over instantly if the primary crashes.

References

Bottom line

CVE-2018-17144 is a High‑severity remote DoS bug that can bring down vulnerable Bitcoin nodes via a crafted duplicate‑input transaction. The fix has been available for years; the critical action for any operator is to ensure the node is running a patched version and to monitor for crash events. Staying up‑to‑date eliminates the risk and preserves network availability.

#CVE #CVE201817144 #Bitcoin #DoS #HighSeverity #Patch