Bitcoin Core Vulnerability Allows Remote Denial of Service (DoS) Attacks via Chain Width Expansion

CVE-2019-25220

What is CVE-2019-25220?

A denial of service vulnerability exists in Bitcoin Core prior to version 24.0.1, where remote attackers can initiate a denial of service attack leading to a crash of the daemon. This vulnerability arises from the inability of the software to verify that a proposed header chain carries sufficient work before it is stored, allowing attackers to exploit the system through a flood of low-difficulty header chains — a tactic referred to as the 'Chain Width Expansion' attack. Ensuring that nodes verify work before accepting chains is crucial for maintaining the integrity and availability of Bitcoin Core.

References