{"id":"CVE-2018-17145","aliases":["EUVD-2020-1115","GHSA-hx3r-jv9q-85jw"],"status":"published","title":"Bitcoin Inventory Out-of-Memory Denial-of-Service Attack (CVE-2018-17145)","description":"Bitcoin Core 0.16.x before 0.16.2 and Bitcoin Knots 0.16.x before 0.16.2 allow remote denial of service via a flood of multiple transaction inv messages with random hashes, aka INVDoS. NOTE: this can also affect other cryptocurrencies, e.g., if they were forked from Bitcoin Core after 2017-11-15.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.04759,"percentile":0.91951,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2020-09-10T16:32:13Z","modified":"2026-10-24T10:50:36Z","fixes":[{"ecosystem":"npm","package":"bcoin","fixed_in":["1.0.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"bcoin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2"}]}]},{"source":"osv","ecosystem":"npm","package":"bcoin","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.2"}]}]}],"products":[{"vendor":"bcoin","product":"bcoin"},{"vendor":"bitcoin","product":"bitcoin_core"},{"vendor":"bitcoinknots","product":"bitcoin_knots"},{"vendor":"btcd_project","product":"btcd"},{"vendor":"decred","product":"dcrd"},{"vendor":"litecoin","product":"litecoin"},{"vendor":"namecoin","product":"namecoin_core"}],"references":[{"url":"https://github.com/bitcoin/bitcoin/blob/v0.16.2/doc/release-notes.md","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web"]},{"url":"https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures#CVE-2018-17145","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://invdos.net/paper/CVE-2018-17145.pdf","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Technical Description","Third Party Advisory","evidence","web"]},{"url":"https://invdos.net","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/bcoin-org/bcoin/security/advisories/GHSA-hx3r-jv9q-85jw","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-17145","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-hx3r-jv9q-85jw"},{"url":"https://github.com/bcoin-org/bcoin","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2018-17145","description":"Bitcoin Core 0.16.x before 0.16.2 and Bitcoin Knots 0.16.x before 0.16.2 allow remote denial of service via a flood of multiple transaction inv messages with random hashes, aka INVDoS. NOTE: this can also affect other cryptocurrencies, e.g., if they were forked from Bitcoin Core after 2017-11-15.","status":"published","published":"2020-09-10T16:32:13Z","modified":"2024-08-05T10:39:59.568Z","updated_at":"2026-11-02T14:35:07.672841Z"}],"euvd":[{"id":"EUVD-2020-1115","description":"Bitcoin Core 0.16.x before 0.16.2 and Bitcoin Knots 0.16.x before 0.16.2 allow remote denial of service via a flood of multiple transaction inv messages with random hashes, aka INVDoS. NOTE: this can also affect other cryptocurrencies, e.g., if they were forked from Bitcoin Core after 2017-11-15.","status":"published","published":"2020-09-10T16:32:13Z","modified":"2024-08-05T10:39:59Z","updated_at":"2026-11-03T02:39:39.229856Z"}],"ghsa":[{"id":"GHSA-hx3r-jv9q-85jw","title":"Bitcoin Inventory Out-of-Memory Denial-of-Service Attack (CVE-2018-17145)","description":"There was an easily exploitable uncontrolled memory resource consumption denial-of-service vulnerability that existed in the peer-to-peer network code of three implementations of Bitcoin and several alternative chains.\n\nFor more details please see:\nhttps://invdos.net/\n\nFor the paper:\nhttps://invdos.net/paper/CVE-2018-17145.pdf","status":"published","published":"2020-09-10T19:44:58Z","modified":"2023-01-09T05:04:27Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:36:10.502376Z"}],"nvd":[{"id":"CVE-2018-17145","description":"Bitcoin Core 0.16.x before 0.16.2 and Bitcoin Knots 0.16.x before 0.16.2 allow remote denial of service via a flood of multiple transaction inv messages with random hashes, aka INVDoS. NOTE: this can also affect other cryptocurrencies, e.g., if they were forked from Bitcoin Core after 2017-11-15.","status":"published","published":"2020-09-10T17:15:25.767Z","modified":"2026-06-17T01:45:25.58Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:05:00.03074Z"}],"osv":[{"id":"CVE-2018-17145","description":"Bitcoin Core 0.16.x before 0.16.2 and Bitcoin Knots 0.16.x before 0.16.2 allow remote denial of service via a flood of multiple transaction inv messages with random hashes, aka INVDoS. NOTE: this can also affect other cryptocurrencies, e.g., if they were forked from Bitcoin Core after 2017-11-15.","status":"published","published":"2020-09-10T17:15:25.767Z","modified":"2026-10-24T10:50:36.62500171Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:08.533609Z"},{"id":"GHSA-hx3r-jv9q-85jw","title":"Bitcoin Inventory Out-of-Memory Denial-of-Service Attack (CVE-2018-17145)","description":"There was an easily exploitable uncontrolled memory resource consumption denial-of-service vulnerability that existed in the peer-to-peer network code of three implementations of Bitcoin and several alternative chains.\n\nFor more details please see:\nhttps://invdos.net/\n\nFor the paper:\nhttps://invdos.net/paper/CVE-2018-17145.pdf","status":"published","published":"2020-09-10T19:44:58Z","modified":"2023-11-08T04:00:03.039349Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:49.621585Z"}]}}