CVE-2023-33297

moderate-risk

Published 2023-05-22

Bitcoin Core before 24.1, when debug mode is not used, allows attackers to cause a denial of service (e.g., CPU consumption) because draining the inventory-to-send queue is inefficient, as exploited in the wild in May 2023.

Do I need to act?

0.36% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Affected Products (1)

Bitcoin Core

Affected Vendors

Bitcoin

References (20)

Not Applicable https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures

Release Notes https://github.com/bitcoin/bitcoin/blob/master/doc/release-notes/release-notes-2...

Issue Tracking https://github.com/bitcoin/bitcoin/issues/27586

Issue Tracking https://github.com/bitcoin/bitcoin/issues/27623

Issue Tracking https://github.com/bitcoin/bitcoin/pull/27610

https://github.com/dogecoin/dogecoin/issues/3243#issuecomment-1712575544

https://github.com/visualbasic6/drain

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

https://x.com/123456/status/1711601593399828530