{"id":"CVE-2023-33297","aliases":["EUVD-2023-37460","GHSA-q9gq-6cqp-445j"],"status":"published","title":"Bitcoin Core before 24.1, when debug mode is not used, allows attackers to cause a denial of...","description":"Bitcoin Core before 24.1, when debug mode is not used, allows attackers to cause a denial of service (e.g., CPU consumption) because draining the inventory-to-send queue is inefficient, as exploited in the wild in May 2023.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.014,"percentile":0.72875,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-400"],"published":"2023-05-22T00:00:00Z","modified":"2026-10-28T02:30:42Z","products":[{"vendor":"bitcoin","product":"bitcoin_core"}],"references":[{"url":"https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures","tags":["x_transferred","Not Applicable","web"]},{"url":"https://github.com/bitcoin/bitcoin/issues/27586","tags":["x_transferred","Issue Tracking","report"]},{"url":"https://github.com/bitcoin/bitcoin/issues/27623","tags":["x_transferred","Issue Tracking","report"]},{"url":"https://github.com/bitcoin/bitcoin/blob/master/doc/release-notes/release-notes-24.1.md","tags":["x_transferred","Release Notes","web"]},{"url":"https://github.com/bitcoin/bitcoin/pull/27610","tags":["x_transferred","Issue Tracking","Patch","fix"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F2EI7SAP4QP2AJYK2JVEOO4GJ6DOBSM5/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H3CQY277NWXY3RFCZCJ4VKT2P3ROACEJ/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://github.com/visualbasic6/drain","tags":["x_transferred","package"]},{"url":"https://github.com/dogecoin/dogecoin/issues/3243#issuecomment-1712575544","tags":["x_transferred","report"]},{"url":"https://x.com/123456/status/1711601593399828530","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33297","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F2EI7SAP4QP2AJYK2JVEOO4GJ6DOBSM5"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H3CQY277NWXY3RFCZCJ4VKT2P3ROACEJ"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F2EI7SAP4QP2AJYK2JVEOO4GJ6DOBSM5"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H3CQY277NWXY3RFCZCJ4VKT2P3ROACEJ"},{"url":"https://github.com/advisories/GHSA-q9gq-6cqp-445j"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33297.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-33297","description":"Bitcoin Core before 24.1, when debug mode is not used, allows attackers to cause a denial of service (e.g., CPU consumption) because draining the inventory-to-send queue is inefficient, as exploited in the wild in May 2023.","status":"published","published":"2023-05-22T00:00:00Z","modified":"2025-01-28T17:20:52.01Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:35:34.55015Z"}],"euvd":[{"id":"EUVD-2023-37460","description":"Bitcoin Core before 24.1, when debug mode is not used, allows attackers to cause a denial of service (e.g., CPU consumption) because draining the inventory-to-send queue is inefficient, as exploited in the wild in May 2023.","status":"published","published":"2023-05-22T00:00:00Z","modified":"2025-01-28T17:20:52Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T00:04:11.289823Z"}],"ghsa":[{"id":"GHSA-q9gq-6cqp-445j","title":"Bitcoin Core before 24.1, when debug mode is not used, allows attackers to cause a denial of...","description":"Bitcoin Core before 24.1, when debug mode is not used, allows attackers to cause a denial of service (CPU consumption) because draining the inventory-to-send queue is inefficient, as exploited in the wild in May 2023.","status":"published","published":"2023-05-22T06:30:15Z","modified":"2024-04-04T04:15:57Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:56:22.389253Z"}],"nvd":[{"id":"CVE-2023-33297","description":"Bitcoin Core before 24.1, when debug mode is not used, allows attackers to cause a denial of service (e.g., CPU consumption) because draining the inventory-to-send queue is inefficient, as exploited in the wild in May 2023.","status":"published","published":"2023-05-22T05:15:09.46Z","modified":"2026-06-17T06:01:31.273Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:08:03.200773Z"}],"osv":[{"id":"CVE-2023-33297","description":"Bitcoin Core before 24.1, when debug mode is not used, allows attackers to cause a denial of service (e.g., CPU consumption) because draining the inventory-to-send queue is inefficient, as exploited in the wild in May 2023.","status":"published","published":"2023-05-22T00:00:00Z","modified":"2026-10-28T02:30:42.269756951Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:32.116263Z"}]}}