CVE-2023-50428
published 2023-12-09CVE-2023-50428: In Bitcoin Core through 26.0 and Bitcoin Knots before 25.1.knots20231115, datacarrier size limits can be bypassed by obfuscating data as code (e.g., with…
PriorityP278medium5.3CVSS 3.1
AVNACLPRNUINSUCNINAL
ITWVulnCheck KEV
Exploited in the wild
EPSS
0.78%
51.3th percentile
In Bitcoin Core through 26.0 and Bitcoin Knots before 25.1.knots20231115, datacarrier size limits can be bypassed by obfuscating data as code (e.g., with OP_FALSE OP_IF), as exploited in the wild by Inscriptions in 2022 and 2023. NOTE: although this is a vulnerability from the perspective of the Bitcoin Knots project, some others consider it "not a bug."
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| bitcoin | bitcoin_core | 0.9 – 26.0 | — |
| bitcoinknots | bitcoin_knots | >= 0.9 < 25.1 | 25.1 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
vulncheck5.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-xjxq-r86x-5mrv: In Bitcoin Core through 27
ghsa_unreviewed·2024-05-01·CVSS 5.3
CVE-2024-34149 [MEDIUM] GHSA-xjxq-r86x-5mrv: In Bitcoin Core through 27
In Bitcoin Core through 27.0 and Bitcoin Knots before 25.1.knots20231115, tapscript lacks a policy size limit check, a different issue than CVE-2023-50428. NOTE: some parties oppose this new limit check (for example, because they agree with the objective but disagree with the technical mechanism, or because they have a different objective).
GHSA
GHSA-9x7v-86jh-jjch: In Bitcoin Core through 26
ghsa_unreviewed·2023-12-09
CVE-2023-50428 [MEDIUM] GHSA-9x7v-86jh-jjch: In Bitcoin Core through 26
In Bitcoin Core through 26.0 and Bitcoin Knots before 25.1.knots20231115, datacarrier size limits can be bypassed by obfuscating data as code (e.g., with OP_FALSE OP_IF), as exploited in the wild by Inscriptions in 2022 and 2023.
VulnCheck
Bitcoin Core and Bitcoin Knots Datacarrier Size Limit Bypass Vulnerability
vulncheck·2023·CVSS 5.3
CVE-2023-50428 [MEDIUM] Bitcoin Core and Bitcoin Knots Datacarrier Size Limit Bypass Vulnerability
Bitcoin Core and Bitcoin Knots Datacarrier Size Limit Bypass Vulnerability
In Bitcoin Core through 26.0 and Bitcoin Knots before 25.1.knots20231115, datacarrier size limits can be bypassed by obfuscating data as code (e.g., with OP_FALSE OP_IF), as exploited in the wild by Inscriptions in 2022 and 2023. NOTE: although this is a vulnerability from the perspective of the Bitcoin Knots project, some others consider it "not a bug."
Affected: bitcoin bitcoin_core
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://x.com/LukeDashjr/status/1732204937466032285; https://www.cve.org/CVERecord?id=CVE-2023-50428
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposureshttps://github.com/bitcoin/bitcoin/blob/65c05db660b2ca1d0076b0d8573a6760b3228068/src/kernel/mempool_options.h#L46-L53https://github.com/bitcoin/bitcoin/pull/28408#issuecomment-1844981799https://github.com/bitcoin/bitcoin/tagshttps://github.com/bitcoinknots/bitcoin/blob/aed49ce8989334c364a219a6eb016a3897d4e3d7/doc/release-notes.mdhttps://twitter.com/LukeDashjr/status/1732204937466032285https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposureshttps://github.com/bitcoin/bitcoin/blob/65c05db660b2ca1d0076b0d8573a6760b3228068/src/kernel/mempool_options.h#L46-L53https://github.com/bitcoin/bitcoin/pull/28408#issuecomment-1844981799https://github.com/bitcoin/bitcoin/tagshttps://github.com/bitcoinknots/bitcoin/blob/aed49ce8989334c364a219a6eb016a3897d4e3d7/doc/release-notes.mdhttps://twitter.com/LukeDashjr/status/1732204937466032285
2023-12-09
Published
Exploited in the wild