CVE-2024-35202

Bitcoin Core before 25.0 allows remote attackers to cause a denial of service (blocktxn message...

7.5 HighFix available

Bitcoin Core before 25.0 allows remote attackers to cause a denial of service (blocktxn message-handling assertion and node exit) by including transactions in a blocktxn message that are not committed to in a block's merkle root. FillBlock can be called twice for one PartiallyDownloadedBlock instance.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.89%Up 0.8 points since Oct 11, 2024

What each source reports

CVE List Score used 7.5

Record: CVE-2024-35202
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-770
Updated: 2026-11-02

EUVDEUVD-2024-35234 7.5

Record: EUVD-2024-35234
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-53v9-6jr7-7fxh 7.5

Bitcoin Core before 25.0 allows remote attackers to cause a denial of service (blocktxn message...

Record: GHSA-53v9-6jr7-7fxh
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-770
Updated: 2026-11-02

NVD 7.5

Record: CVE-2024-35202
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-770
Updated: 2026-11-02

OSV 7.5

Record: CVE-2024-35202
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVopenSUSE-SU-2026:11073-1 No score

bitcoin-qt6-31.0-2.1 on GA media

These are all security issues fixed in the bitcoin-qt6-31.0-2.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:11073-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:21149-1 No score

Security update for bitcoin

This update for bitcoin fixes the following issues:

Changes in bitcoin:

Reference the tracking bugs for CVEs already fixed in current bitcoin (the affected versions all predate the shipped release):
- CVE-2018-20587 (boo#1125092)
- CVE-2019-15947 (boo#1149711)
- CVE-2020-14198 (boo#1181786)
- CVE-2021-3195 (boo#1181784)
- CVE-2023-37192 (boo#1217678)
- CVE-2024-35202 (boo#1231507)

Record: openSUSE-SU-2026:21149-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`bitcoin` openSUSE:Tumbleweed	before 31.0-2.1	31.0-2.1
`bitcoin` openSUSE:Leap 16.0	before 27.1-bp160.2.1	27.1-bp160.2.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-35202 is a high vulnerability (CVSS 7.5) in Bitcoin, published October 10, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.89%, the 59th percentile. Fixed in bitcoin 31.0-2.1.

References

Show 14 moreShow less