CVE-2024-34149General

There are two specific vulnerabilities in Bitcoin Core that could have been fixed and avoided any talk of a fork. These are: CVE-2023-50428: Bypass of datacarriersize limit using OP_FALSE OP_IF CVE-2024-34149: Policy script size limits not enforced for Tapscript CVE stands for Common Vulnerability and Exposure, which provides a database of security vulnerabilities. The issues allowing spam to propagate freely on Bitcoin were acknowledged as vulnerabilities and made it into the CVE database. From a cybersecurity perspective, fixing vulnerabilities is a no brainer, even if the effect of the fix isn't perfect. Basic code changes would have at least made it so that the latest versions of Core and onward would not have that specific bug. The issues were fixed in Knots 25.1. Varying rationale has been given for not implementing the proposed fixes, but to me, all that has happened is that two bugs weren't fixed. I don't care that spammers would have an alternate method of getting their transactions relayed. The official policy of the reference implementation would be that relaying those transactions is non-standard. Policy defaults matter. Standards matter. Friction matters. This whole problem could have been solved ages ago by Core practicing basic vulnerability management.

Not dramatic enough after all that ↓ - Core to this day refuses to patch the inscriptions bugs CVE-2023-50428 and CVE-2024-34149. - Core rejected proposed patch, PR #28408, in JAN 2024 - Adding an insult to an injury, Core merged PR #32406, despite 75% NACK votes. They even locked Github, to prevent more NACK and ninja opened it to allow ACK votes. BIP110 is a proper response to all that. Again, plebs are not dramatic enough, after more than 2 years of gaslighting and hand waving.

@lukedewolf @hodlonaut The main two are: CVE-2023-50428: Bypass of datacarriersize limit using OP_FALSE OP_IF CVE-2024-34149: Policy script size limits not enforced for Tapscript Either one of these being fixed would have made Inscriptions non-viable.

@calibrated_lies @BTCtoOblivion @ProductionReady @Excellion @jimmysong @parkeralewis @jratcliff If the real goal is to damage Bitcoin; This could be a way to not fix the real issues: CVE-2023-50428 and CVE-2024-34149 In other words, to increase the noise to make the real signal to go away.

FrickFracck, thing were fine until 2023 when ordinals happened. - Core to this day refuses to patch the inscriptions bugs CVE-2023-50428 and CVE-2024-34149. - Adding an insult to an injury, Core merged PR #32406, despite 75% NACK votes. They even locked Github, to prevent more NACK and ninja opened it to allow ACK votes. BIP110 is a proper response to all that.

Leurico, that's an utter BS. It's been going on since 2023. Core continuously refuse to do anything about inscriptions bugs listed as CVE-2023-50428 and CVE-2024-34149. Core, with straight face, closed Luke's proposal to fix the exploits, PR #28408, in JAN 2024. Plebs waiting only added an insult to an injury, when Core merged PR #32406, default policy change and activated in Core v30 in OCT 2025.

@Degen_chi @BTCtoOblivion @SGBarbour Did the maintainers at "core" did the work we expected them to do and implement the fix for: CVE-2023-50428 and CVE-2024-34149?

@dadrabbot @GrassFedBitcoin Could explain to us why the CVEs below are not fixed? CVE-2023-50428 CVE-2024-34149

@axexang @stephanlivera CVE-2023-50428 and CVE-2024-34149 are not an issue for the network or for me as a node operator who cares about efficiency and savings. This is just a fact, but it's really hard to argue with extremely stupid people who are also non technical.

@axexang @BtcLiberty @notgrubles @NickSzabo4 @_bholm @Rombbb_Gaming @asanoha_gold I see! Thanks for the references. Both CVEs you mention are not about Mempool UTXOs living on the RAM. People can read them here: https://nvd.nist.gov/vuln/detail/CVE-2024-34149 (AWAITING ANALYSIS) https://nvd.nist.gov/vuln/detail/CVE-2023-50428 (...some consider it "not a bug."...)

@brt2412 @Krev2323 @w_s_bitcoin It is junk because it adds a negative monetary value to the Bitcoin network. It is only possible because "core" refused to fix major security issues: CVE-2023-50428 and CVE-2024-34149

@Krev2323 @brt2412 @w_s_bitcoin Rug the sc@mmers! This world does not one more sh|tcoin, and the BIP will be enabled. Are you really thinking that Bitcoiners are too dumb to not fix major security issues (CVE-2023-50428, CVE-2024-34149...)?

@_jfrader @BTC_for_Freedom This is not a "little spam"; Bitcoin is not a database, and this junk has a direct impact on the RAM usage of a node. This attack is possible because two CVEs were not fixed: CVE-2023-50428 and CVE-2024-34149; "core" is directly responsible for this!

@Vorstand1 @notgrubles Which is only possible because of CVEs (CVE-2023-50428, CVE-2024-34149) which where not fixed. Not fixing a CVE is more than incompetence.

@baclfoo @GrassFedBitcoin @BTCsessions Indeed, but not at this rate which is not in line with the hardware improvements. This is a consequence of CVE-2023-50428 and CVE-2024-34149 which are major security issues.

@jturner @BitcoinUndisc @notgrubles @theonevortex The gentleman agreement we had was to use "filters" at the mempool level (before CVE-2023-50428 and CVE-2024-34149) to remove the junk which is harmful to Bitcoin. "Core" found a way to not fixes these CVEs (gazlighting…).

Luke de Wolf highlighted two CVEs in Bitcoin Core (CVE-2023-50428 and CVE-2024-34149) that were never fixed in Core but were addressed in Knots 25.1. Both relate to policy limits that, if bypassed, make it easier for spam transactions to propagate. These were formally acknowledged as vulnerabilities in the CVE database. From my vantage point, the real issue isn’t just the bugs themselves — it’s the signal that Core has become slower to prioritize spam resistance fixes, while alternative implementations like Knots move faster on them. This dynamic is worth watching. Do you see this as a healthy sign of client diversity, or as a growing problem for Bitcoin’s base layer hygiene?

Luke de Wolf highlighted two CVEs in Bitcoin Core (CVE-2023-50428 and CVE-2024-34149) that were never fixed in Core but were addressed in Knots 25.1. Both relate to policy limits that, if bypassed, make it easier for spam transactions to propagate. These were formally acknowledged as vulnerabilities in the CVE database. From my vantage point, the real issue isn’t just the bugs themselves — it’s the signal that Core has become slower to prioritize spam resistance fixes, while alternative implementations like Knots move faster on them. This dynamic is worth watching. Do you see this as a healthy sign of client diversity, or as a growing problem for Bitcoin’s base layer hygiene?

@scottmsul @matteopelleg Bip 110 will make Bitcoin sound money again by fixing the major security issues that "core" refused deliberately to fix (CVE-2023-50428 and CVE-2024-34149).

@gsovereigntyg @orthodoxbitcoin Of course not; This new "core" team has only one objective letting the major security issues opened: CVE-2023-50428 and CVE-2024-34149 which is required if you want to transform Bitcoin into a regular sh|tcoin. As you could see their major achievement is from 2023 and it shows.