Loading story…
Bitcoin Core developers disclosed a high-severity memory denial-of-service flaw, tracked as CVE-2019-25220, that allowed attackers to crash vulnerable nodes by flooding them with long, low-difficulty header chains. The bug affected versions before 24.0.1 and was estimated to expose roughly 17% of the network at disclosure, with the cost of mounting the attack falling from about 4.12 BTC in 2019 to roughly 0.14 BTC by September 2024. Bitcoin Core said the issue was fixed in PR #25717, which added cumulative-work verification before storing headers in memory, while a later pre-synchronization bug was addressed in PR #26355.
The disclosure came alongside a broader push to address risks from outdated Bitcoin Core software, with developers publishing older fixed vulnerabilities that still affected a meaningful share of active nodes. Reported issues in legacy releases included censorship of unconfirmed transactions, netsplits, additional denial-of-service conditions, memory-related crashes, and less common flaws that could enable remote code execution or CPU and memory exhaustion. Bitcoin Core also adopted a formal security disclosure policy with low, medium, high, and critical severity tiers, aiming to improve transparency and pressure node operators to upgrade; one analysis cited about 787 active nodes still running versions older than 0.21.0.
See affected versions and whether adversaries are exploiting it.
7 events from the most recent confirmed update back to the earliest known activity.
Follow-on reporting said a critical Bitcoin Core vulnerability still threatened more than 13% of nodes, underscoring continued exposure among operators running outdated software after disclosure and patch availability. This reflected the ongoing risk from lagging upgrades across the network.
Analysis of the disclosed header-spam vulnerability emphasized that malicious miners could use it to disrupt competing pools, reduce effective network hash rate, or create more favorable conditions for double-spending. By September 2024, the estimated attack cost had dropped to about 0.14 BTC.
Bitcoin Core published details of CVE-2019-25220, a high-severity memory exhaustion flaw affecting versions before 24.0.1 that could remotely crash peers. The disclosure said the attack cost had fallen over time, making exploitation increasingly practical against outdated nodes.
Later coverage of Bitcoin Core's older disclosed vulnerabilities said roughly 6% of active nodes were still running outdated software affected by issues including transaction censorship, denial of service, crashes, and less common remote code execution or resource exhaustion flaws. The reporting reiterated that the new disclosure policy was meant to improve transparency and drive upgrades.
Bitcoin Core developers introduced a formal security disclosure policy with four severity levels and disclosed multiple previously fixed vulnerabilities affecting outdated versions. The move was intended to improve transparency and push node operators to upgrade unsupported software.
The last vulnerable release line, Bitcoin Core 23.2, reached end of life, satisfying the project's policy condition for later public disclosure of the header-spam DoS issue. Older unsupported nodes remained exposed if not upgraded.
Bitcoin Core addressed a high-severity denial-of-service flaw that let attackers crash nodes by spamming extremely long low-difficulty header chains. The fix was implemented in PR #25717 and shipped in Bitcoin Core 24.0.1.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
keyhunters.ru
Open sourcecryptodnes.bg
Open sourcecoinspect.com
Open sourcebitcoincore.org
Open sourcecryptobriefing.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Node.js released security updates for supported 20.x, 22.x, 24.x, and 25.x branches to fix **two high-severity**, **five medium-severity**, and **two low-severity** vulnerabilities, with patched versions issued as `v20.20.2`, `v22.22.2`, `v24.14.1`, and `v25.8.2`. The most serious bug, `CVE-2026-21637`, was an incomplete fix in TLS `SNICallback` handling that could be triggered remotely to cause an uncaught exception and crash affected processes. A second high-severity issue, `CVE-2026-21710`, allowed specially crafted HTTP requests using a `__proto__` header name to trigger a denial of service when applications accessed `req.headersDistinct`. The release also addressed Permission Model bypasses, a native crash in URL formatting, a timing side-channel in HMAC verification, an HTTP/2 flow-control memory leak that could lead to memory exhaustion, and a V8 **HashDoS** weakness; Node.js also updated the `undici` dependency on 22.x, 24.x, and 25.x to remediate public vulnerabilities. Debian published a corresponding `nodejs` security update, and the Canadian Centre for Cyber Security urged administrators to review vendor guidance and apply the patched releases, with internet-facing TLS servers identified as the highest-priority systems for remediation.
Jul 29, 2026
Node.js released security updates for all active release lines, shipping **v22.23.2**, **v24.18.1**, and **v26.5.1** to fix 11 vulnerabilities affecting the 22.x, 24.x, and 26.x branches. The most serious issues include two high-severity HTTP/2 flaws, `CVE-2026-56846` and `CVE-2026-56848`, which could let attackers trigger denial of service through memory exhaustion or process crashes, and `CVE-2026-58043`, a high-severity bypass in the Permission Model that could allow applications started with `--permission` to access filesystem paths outside the intended allowlist. The update also addresses weaknesses involving HTTPS connection reuse, mTLS identity reuse, hostname verification bypass, DNS handling, SQLite, zlib APIs, and an HTTP parser issue that could enable request smuggling in Node.js-based forwarding proxies. An oss-sec follow-up noted that an earlier announcement linked to the wrong Node.js blog entry and should instead reference the July security releases page, while maintainers emphasized that unsupported Node.js versions remain exposed and should be retired or upgraded immediately.
Jul 30, 2026
Several critical vulnerabilities have been disclosed affecting a range of widely used software frameworks and hardware platforms. Notable issues include a critical flaw in the Apache bRPC framework (CVE-2025-59789) that exposes high-performance systems to crash risks, a high-severity unauthenticated XXE vulnerability in GeoServer (CVE-2025-58360) enabling file theft and SSRF, and a critical SQL injection vulnerability in Devolutions Server (CVE-2025-13757) that allows authenticated attackers to steal all stored passwords. Additional disclosures include a proof-of-concept exploit for a Windows Administrator Protection elevation of privilege vulnerability (CVE-2025-60718), a critical boot process compromise in Snapdragon 8 Gen 3 and 5G modems (CVE-2025-47372), and a flaw in Apache Kvrocks that allows privilege escalation via the 'RESET' command. A separate high-severity vulnerability (CVE-2025-61618) was identified in Unisoc T8100/T9100/T8200/T8300 chipsets, affecting Android devices and allowing remote denial of service through improper input validation in the NR modem. These vulnerabilities collectively highlight the ongoing risk posed by both software and hardware flaws, with several enabling remote code execution, privilege escalation, or denial of service. Organizations using affected products should prioritize patching and mitigation efforts to reduce exposure to these critical threats.
Jun 29, 2026