Description
Bitcoin Core 0.14.x before 0.14.3, 0.15.x before 0.15.2, and 0.16.x before 0.16.3 and Bitcoin Knots 0.14.x through 0.16.x before 0.16.3 allow a remote denial of service (application crash) exploitable by miners via duplicate input. An attacker can make bitcoind or Bitcoin-Qt crash.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | litecoin | 0.16.3-1 | — |
| Debian 12 | litecoin | 0.16.3-1 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP5 | bitcoin | 26.0-bp155.2.3.1 | openSUSE-SU-2024:0052-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.5 | bitcoin | 26.0-bp155.2.3.1 | openSUSE-SU-2024:0052-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
hikame/CVE-2018-17144_POC ★ 8 · Oct 31, 2018
Put the *.py files to test/functional folder of bitcoin sourcecode (commit: 4901c00792c1dabae4bb01e6373c9b1ed9ef3008)
-
iioch/ban-exploitable-bitcoin-nodes ★ 2 · Oct 10, 2018
Ban all denial-of-service vulnerability exploitable nodes from your node CVE-2018-17144
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- openSUSE-SU-2024:0052-1 Security update for bitcoin SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures#CVE-2018-17144
- https://github.com/bitcoin/bitcoin/blob/v0.16.3/doc/release-notes.md
- https://bitcoincore.org/en/2018/09/18/release-0.16.3/
- https://github.com/bitcoinknots/bitcoin/blob/v0.16.3.knots20180918/doc/release-notes.md
- https://github.com/JinBean/CVE-Extension