CVE-2024-34478

btcd susceptible to consensus failures

7.5 HighFix available

btcd before 0.24.0 does not correctly implement the consensus rules outlined in BIP 68 and BIP 112, making it susceptible to consensus failures. Specifically, it uses the transaction version as a signed integer when it is supposed to be treated as unsigned. There can be a chain split and loss of funds.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

Exploit likelihood

0.56%Up 0.5 points since May 5, 2024

What each source reports

CVE List Score used 7.5

Record: CVE-2024-34478
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-436
Updated: 2026-11-02

EUVDEUVD-2024-1391 7.5

Record: EUVD-2024-1391
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-3jgf-r68h-xfqm No score

btcd susceptible to consensus failures

Record: GHSA-3jgf-r68h-xfqm
Weakness: CWE-436
Updated: 2026-11-02

NVD 7.5

Record: CVE-2024-34478
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-436
Updated: 2026-11-02

OSV 7.5

Record: CVE-2024-34478
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVGHSA-3jgf-r68h-xfqm No score

btcd susceptible to consensus failures

Record: GHSA-3jgf-r68h-xfqm
Weakness: CWE-436
Updated: 2026-11-02

OSVGO-2024-2818 No score

Consensus failures in github.com/btcsuite/btcd

Incorrect implementation of the consensus rules outlined in BIP 68 and BIP 112 making btcd susceptible to consensus failures. Specifically, it uses the transaction version as a signed integer when it is supposed to be treated as unsigned. There can be a chain split and loss of funds.

Record: GO-2024-2818
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`github.com/btcsuite/btcd` Go	before 0.24.0	0.24.0

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-34478 is a high vulnerability (CVSS 7.5) in Btcd, published May 5, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.56%, the 46th percentile. Fixed in github.com/btcsuite/btcd 0.24.0.

References

Show 4 moreShow less