{"id":"CVE-2017-9230","aliases":["EUVD-2017-18168","GHSA-hx58-x97g-cc9p"],"status":"disputed","title":"** DISPUTED ** The Bitcoin Proof-of-Work algorithm does not consider a certain attack methodology...","description":"The Bitcoin Proof-of-Work algorithm does not consider a certain attack methodology related to 80-byte block headers with a variety of initial 64-byte chunks followed by the same 16-byte chunk, multiple candidate root values ending with the same 4 bytes, and calculations involving sqrt numbers. This violates the security assumptions of (1) the choice of input, outside of the dedicated nonce area, fed into the Proof-of-Work function should not change its difficulty to evaluate and (2) every Proof-of-Work function execution should be independent. NOTE: a number of persons feel that this methodology is a benign mining optimization, not a vulnerability","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03251,"percentile":0.88418,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-338"],"published":"2017-05-24T16:00:00Z","modified":"2026-06-17T01:27:43Z","products":[{"vendor":"bitcoin","product":"bitcoin"}],"references":[{"url":"https://arxiv.org/ftp/arxiv/papers/1604/1604.00575.pdf","tags":["x_refsource_MISC","x_transferred","Technical Description"]},{"url":"https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2017-April/013996.html","tags":["x_refsource_MISC","x_transferred","Mailing List","Technical Description","Third Party Advisory"]},{"url":"https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2017-May/014351.html","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/98657","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2017-May/014352.html","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory"]},{"url":"https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2017-May/014349.html","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory"]},{"url":"http://www.mit.edu/~jlrubin//public/pdfs/Asicboost.pdf","tags":["x_refsource_MISC","x_transferred","Technical Description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9230"},{"url":"https://github.com/advisories/GHSA-hx58-x97g-cc9p"}],"sources":{"cve":[{"id":"CVE-2017-9230","description":"The Bitcoin Proof-of-Work algorithm does not consider a certain attack methodology related to 80-byte block headers with a variety of initial 64-byte chunks followed by the same 16-byte chunk, multiple candidate root values ending with the same 4 bytes, and calculations involving sqrt numbers. This violates the security assumptions of (1) the choice of input, outside of the dedicated nonce area, fed into the Proof-of-Work function should not change its difficulty to evaluate and (2) every Proof-of-Work function execution should be independent. NOTE: a number of persons feel that this methodology is a benign mining optimization, not a vulnerability","status":"disputed","published":"2017-05-24T16:00:00Z","modified":"2024-08-05T17:02:43.38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-338"],"updated_at":"2026-11-02T14:33:13.606903Z"}],"euvd":[{"id":"EUVD-2017-18168","description":"The Bitcoin Proof-of-Work algorithm does not consider a certain attack methodology related to 80-byte block headers with a variety of initial 64-byte chunks followed by the same 16-byte chunk, multiple candidate root values ending with the same 4 bytes, and calculations involving sqrt numbers. This violates the security assumptions of (1) the choice of input, outside of the dedicated nonce area, fed into the Proof-of-Work function should not change its difficulty to evaluate and (2) every Proof-of-Work function execution should be independent. NOTE: a number of persons feel that this methodology is a benign mining optimization, not a vulnerability","status":"published","published":"2017-05-24T16:00:00Z","modified":"2024-08-05T17:02:43Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T02:23:28.642509Z"}],"ghsa":[{"id":"GHSA-hx58-x97g-cc9p","title":"** DISPUTED ** The Bitcoin Proof-of-Work algorithm does not consider a certain attack methodology...","description":"** DISPUTED ** The Bitcoin Proof-of-Work algorithm does not consider a certain attack methodology related to 80-byte block headers with a variety of initial 64-byte chunks followed by the same 16-byte chunk, multiple candidate root values ending with the same 4 bytes, and calculations involving sqrt numbers. This violates the security assumptions of (1) the choice of input, outside of the dedicated nonce area, fed into the Proof-of-Work function should not change its difficulty to evaluate and (2) every Proof-of-Work function execution should be independent. NOTE: a number of persons feel that this methodology is a benign mining optimization, not a vulnerability.","status":"published","published":"2022-05-14T03:18:09Z","modified":"2023-02-02T05:07:36Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-338"],"updated_at":"2026-11-02T14:52:32.871435Z"}],"nvd":[{"id":"CVE-2017-9230","description":"The Bitcoin Proof-of-Work algorithm does not consider a certain attack methodology related to 80-byte block headers with a variety of initial 64-byte chunks followed by the same 16-byte chunk, multiple candidate root values ending with the same 4 bytes, and calculations involving sqrt numbers. This violates the security assumptions of (1) the choice of input, outside of the dedicated nonce area, fed into the Proof-of-Work function should not change its difficulty to evaluate and (2) every Proof-of-Work function execution should be independent. NOTE: a number of persons feel that this methodology is a benign mining optimization, not a vulnerability","status":"disputed","published":"2017-05-24T16:29:00.18Z","modified":"2026-06-17T01:27:43.267Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-338"],"updated_at":"2026-11-02T14:03:49.449157Z"}]}}