Every CVESearch/Get API key

CVE-2024-34478

btcd susceptible to consensus failures

7.5 HighFix available

CVE-2024-34478 is a high vulnerability (CVSS 7.5) in Btcd, published May 5, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.56%, the 47th percentile. Fixed in github.com/btcsuite/btcd 0.24.0.

What does this mean?
Severity
7.5 HighCVSS 3.1, CVE List
Exploit chance
0.56%EPSS, 47th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
0.24.0github.com/btcsuite/btcd

Description

btcd before 0.24.0 does not correctly implement the consensus rules outlined in BIP 68 and BIP 112, making it susceptible to consensus failures. Specifically, it uses the transaction version as a signed integer when it is supposed to be treated as unsigned. There can be a chain split and loss of funds.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

0.56%Up 0.5 points since May 5, 2024
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/btcsuite/btcd
Go
before 0.24.0
0.24.0

What each source reports

CVE List Score used7.5

btcd before 0.24.0 does not correctly implement the consensus rules outlined in BIP 68 and BIP 112, making it susceptible to consensus failures. Specifically, it uses the transaction version as a signed integer when it is supposed to be treated as unsigned. There can be a chain split and loss of funds.

Record
CVE-2024-34478
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-436
Updated
2026-11-02
EUVDEUVD-2024-13917.5

btcd before 0.24.0 does not correctly implement the consensus rules outlined in BIP 68 and BIP 112, making it susceptible to consensus failures. Specifically, it uses the transaction version as a signed integer when it is supposed to be treated as unsigned. There can be a chain split and loss of funds.

Record
EUVD-2024-1391
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-3jgf-r68h-xfqmNo score

btcd susceptible to consensus failures

btcd before 0.24.0 does not correctly implement the consensus rules outlined in BIP 68 and BIP 112, making it susceptible to consensus failures. Specifically, it uses the transaction version as a signed integer when it is supposed to be treated as unsigned. There can be a chain split and loss of funds.

Record
GHSA-3jgf-r68h-xfqm
Weakness
CWE-436
Updated
2026-11-02
NVD7.5

btcd before 0.24.0 does not correctly implement the consensus rules outlined in BIP 68 and BIP 112, making it susceptible to consensus failures. Specifically, it uses the transaction version as a signed integer when it is supposed to be treated as unsigned. There can be a chain split and loss of funds.

Record
CVE-2024-34478
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-436
Updated
2026-11-02
OSV7.5

btcd before 0.24.0 does not correctly implement the consensus rules outlined in BIP 68 and BIP 112, making it susceptible to consensus failures. Specifically, it uses the transaction version as a signed integer when it is supposed to be treated as unsigned. There can be a chain split and loss of funds.

Record
CVE-2024-34478
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVGHSA-3jgf-r68h-xfqmNo score

btcd susceptible to consensus failures

btcd before 0.24.0 does not correctly implement the consensus rules outlined in BIP 68 and BIP 112, making it susceptible to consensus failures. Specifically, it uses the transaction version as a signed integer when it is supposed to be treated as unsigned. There can be a chain split and loss of funds.

Record
GHSA-3jgf-r68h-xfqm
Weakness
CWE-436
Updated
2026-11-02
OSVGO-2024-2818No score

Consensus failures in github.com/btcsuite/btcd

Incorrect implementation of the consensus rules outlined in BIP 68 and BIP 112 making btcd susceptible to consensus failures. Specifically, it uses the transaction version as a signed integer when it is supposed to be treated as unsigned. There can be a chain split and loss of funds.

Record
GO-2024-2818
Updated
2026-11-02

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 4 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open