The Bitcoin network has faced various security challenges over the years, leading to the identification and documentation of multiple Common Vulnerabilities and Exposures (CVEs). This article provides an overview of significant CVEs that have impacted Bitcoin, emphasizing the network’s ongoing evolution in security practices.

List of Notable Bitcoin CVEs:

Detailed Insights into Select Bitcoin CVEs

CVE-2010-5137

Date: July 28, 2010

  • Summary: A bug involving OP_LSHIFT caused crashes in Bitcoin clients. This vulnerability was never exploited on the main network and was fixed in Bitcoin version 0.3.5. Several currently unused script words were disabled post-discovery for security reasons.

CVE-2010-5141

Date: July 28, 2010

  • Summary: This bug allowed attackers to spend coins they did not own. It was also addressed in version 0.3.5, with preventive security measures similar to those taken for CVE-2010-5137.

CVE-2010-5138

Date: July 29, 2010

  • Summary: This vulnerability involved block 71036 containing multiple transactions with an excessive number of OP_CHECKSIG operations, leading to potential Denial of Service attacks. A new Bitcoin version was promptly released to address this issue.

CVE-2010-5139

Date: August 15, 2010

  • Summary: A transaction in block 74638 created over 184 billion Bitcoins across two addresses due to an overflow in output value summation. This resulted in a blockchain fork, which was later resolved by surpassing the faulty chain at block 74691.

CVE-2010-5140

Date: September 29, 2010

  • Summary: Users reported unconfirmed transactions due to changes in the Bitcoin code allowing transactions under 0.01 without a fee. These transactions remained unconfirmed indefinitely. The network later required a 0.01 fee for such transactions, and a fix was implemented.

CVE-2011-4447

Date: Prior to versions 0.4.1 and 0.5.0rc

  • Summary: The ‘encrypt wallet’ function in wxBitcoin and Bitcoin 0.4.x had an improper interaction with the deletion functionality of BSDDB, leading to potential exposure of unencrypted private keys from the Bitcoin wallet file.

CVE-2012-1909

Date: Versions before 0.4.4

  • Summary: This issue in bitcoind, wxBitcoin, Bitcoin-Qt, and other programs using the Bitcoin protocol involved failure to handle multiple transactions with the same identifiers, leading to denial of service through duplicate coinbase transactions.

CVE-2012-1910

Date: Prior to Bitcoin-Qt 0.8.0rc4 on Windows

  • Summary: The application did not use MinGW’s multi-thread safe exception handling, which allowed remote attackers to cause a denial of service or potentially execute arbitrary code through crafted Bitcoin protocol messages.

CVE-2012-2459

  • Summary: A vulnerability where block hash collisions could be easily achieved by duplicating transactions in the Merkle Tree. These collisions were invalid but could be used to fork the blockchain

and potentially enable double-spend attacks.

CVE-2012-3789

Date: May 2012

  • Summary: Two vulnerabilities were reported, with the more severe one allowing a connected peer to hang the victim’s client as a denial of service attack by sending a series of specially crafted transactions.

To create a professional and comprehensive English technical article from your provided content about various Bitcoin CVEs, I will organize, refine, and present the information in an informative manner. Here’s the revised version:

CVE-2012-4684

  • Issue: In version 0.7.0, alerts were identified by the hash of the message, including the signature. This design flaw allowed attackers to circulate a large number of valid alerts by altering the signature of existing alerts.
  • Impact: This vulnerability could lead to RAM exhaustion, potentially stopping all Bitcoin nodes in the network.

CVE-2013-2272

  • Issue: The CTxMemPool::accept method in bitcoind included a penny-flooding protection mechanism. However, this mechanism allowed remote attackers to determine associations between wallet addresses and IP addresses through a series of large, fee-deficient Bitcoin transactions.
  • Impact: This vulnerability compromised user privacy by exposing the links between wallet and IP addresses.

CVE-2013-2273

  • Issue: Earlier versions of bitcoind and Bitcoin-Qt had vulnerabilities that allowed remote attackers to obtain potentially sensitive information about returned change due to predictable outputs in Bitcoin transactions.
  • Impact: This issue raised concerns about transaction privacy and user information security.

CVE-2013-2292 and CVE-2013-2293

  • Issue: Prior versions of bitcoind and Bitcoin-Qt were vulnerable to non-standard Bitcoin transactions with multiple OP_CHECKSIG script opcodes, causing denial of service. These versions were also susceptible to attacks that forced excessive reading of blockchain parts, delaying other processing.
  • Impact: These vulnerabilities could lead to network disruptions and impact the efficiency of transaction processing.

CVE-2013-3219

  • Issue: Older versions of bitcoind and Bitcoin-Qt with Berkeley DB locks allowed remote attackers to bypass access restrictions and perform double-spending by triggering errors in large blocks.
  • Impact: This flaw exposed the network to double-spending attacks, undermining the blockchain’s reliability.

CVE-2013-3220

  • Issue: An incorrect assessment of block size, potentially requiring excessive database locks, allowed remote attackers to cause a denial of service (split) and enable certain double-spend functionalities.
  • Impact: This issue threatened the network’s stability and opened up possibilities for double-spending attacks.

CVE-2013-4627

  • Date: June 2013
  • Summary: Memory exhaustion caused by excessive Tx information
  • Fix Deployment: 99.9%
  • Details: This vulnerability allowed remote attackers to cause a Denial of Service (DoS) through memory consumption by sending large amounts of Tx messages.

CVE-2013-4165

  • Date: July 20, 2013
  • Summary: Time leak in RPC authentication
  • Fix Deployment: 99.9%
  • Details: In bitcoind 0.8.1, the HTTPAuthorized function in bitcoinrpc.cpp revealed information about authentication failures upon detecting the first incorrect byte of a password. This vulnerability made it easier for remote attackers to determine passwords through timing side-channel attacks.

CVE-2013-5700

  • Date: September 4, 2013
  • Summary: Remote P2P crash via bloom filters
  • Fix Deployment: 99.9%
  • Details: The Bloom Filter implementation in bitcoind and Bitcoin-Qt 0.8.x (up to 0.8.4rc1) allowed remote attackers to cause a denial of service (division by zero error and daemon crash) through a specially crafted message sequence.

CVE-2016-8889

  • Date: October 27, 2016
  • Summary: Debug console log storing sensitive information
  • Fix Deployment: 100%
  • Details: In Bitcoin Knots from v0.11.0.ljr20150711 to v0.13.0.knots20160814 (fixed in v0.13.1.knots20161027), the debug console stored sensitive information, including private keys and wallet passwords, in its command history log.

CVE-2018-17144

  • Date: September 17, 2018
  • Summary: Missing checks for duplicate inputs
  • Fix Deployment: 13%
  • Related Reads:
    1. CVE-2018-17144: The Aftermath of a Catastrophic Bitcoin Bug
    2. Bitcoin Core Bug CVE-2018–17144: An Analysis
  • Details: This critical bug involved a lack of checks for duplicate transactions. It posed a significant threat to the network’s integrity, allowing potential inflation of Bitcoin beyond its 21 million cap and leading to double-spending vulnerability. This CVE was particularly alarming due to its potential impact on the entire Bitcoin blockchain’s trust and security.