CVE-2018-17144

Bitcoin Core 0.14.x before 0.14.3, 0.15.x before 0.15.2, and 0.16.x before 0.16.3 and Bitcoin...

7.5 HighPublic exploitFix available

Bitcoin Core 0.14.x before 0.14.3, 0.15.x before 0.15.2, and 0.16.x before 0.16.3 and Bitcoin Knots 0.14.x through 0.16.x before 0.16.3 allow a remote denial of service (application crash) exploitable by miners via duplicate input. An attacker can make bitcoind or Bitcoin-Qt crash.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

6.75%Down 1.4 points since Apr 14, 2021

What each source reports

NVD Score used 7.5

Record: CVE-2018-17144
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Updated: 2026-11-02

CVE List No score

Record: CVE-2018-17144
Updated: 2026-11-02

EUVDEUVD-2018-8920 No score

Record: EUVD-2018-8920
Updated: 2026-11-03

GitHub AdvisoriesGHSA-35hw-99vw-mgp5 7.5

Bitcoin Core 0.14.x before 0.14.3, 0.15.x before 0.15.2, and 0.16.x before 0.16.3 and Bitcoin...

Record: GHSA-35hw-99vw-mgp5
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSV 7.5

Record: CVE-2018-17144
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2018-17144 7.5

Record: DEBIAN-CVE-2018-17144
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVMGASA-2018-0415 No score

Updated bitcoin packages fix security vulnerability

Remote denial of service (application crash) exploitable by miners via duplicate input (CVE-2018-17144).

Record: MGASA-2018-0415
Updated: 2026-11-02

OSVopenSUSE-SU-2024:0052-1 No score

Security update for bitcoin

This update for bitcoin fixes the following issues:

Update to version 26.0, including the following changes:

Enable LTO and test package for Leap
Enable sqlite3 support for wallet
Enable asm optimizations unconditionally

Record: openSUSE-SU-2024:0052-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10654-1 No score

bitcoin-qt5-0.21.1-2.2 on GA media

These are all security issues fixed in the bitcoin-qt5-0.21.1-2.2 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10654-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`litecoin` Debian:12	before 0.16.3-1	0.16.3-1
`litecoin` Debian:13	before 0.16.3-1	0.16.3-1
`bitcoin` Mageia:6	before 0.16.3-1.mga6	0.16.3-1.mga6
`bitcoin` SUSE:Package Hub 15 SP5	before 26.0-bp155.2.3.1	26.0-bp155.2.3.1
`bitcoin` openSUSE:Leap 15.5	before 26.0-bp155.2.3.1	26.0-bp155.2.3.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	hikame/CVE-2018-17144_POC	2018-10-31
PoC in GitHub	iioch/ban-exploitable-bitcoin-nodes	2018-10-10

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-17144 is a high vulnerability (CVSS 7.5) in Bitcoin Core, published September 19, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 6.75%, the 93rd percentile. Fixed in litecoin 0.16.3-1.

References

Show 8 moreShow less