CVE-2025-54605: Bitcoin Core DOS Vulnerability

CVE-2025-54605 Overview

CVE-2025-54605 is an uncontrolled resource consumption vulnerability affecting Bitcoin Core through version 29.0. The flaw allows remote attackers to exhaust system resources on affected nodes without authentication or user interaction. This is the second of two related resource consumption issues disclosed by the Bitcoin Core project on October 24, 2025. The vulnerability is classified under CWE-400 and impacts the availability of Bitcoin Core nodes participating in the peer-to-peer network. Successful exploitation can degrade node performance or cause denial of service conditions across affected systems.

Critical Impact

Remote, unauthenticated attackers can trigger resource exhaustion on Bitcoin Core nodes through version 29.0, disrupting availability of participating nodes in the Bitcoin peer-to-peer network.

Affected Products

• Bitcoin Core versions up to and including 29.0
• Bitcoin Core nodes operating as full validators on the Bitcoin network
• Downstream forks and derivatives based on vulnerable Bitcoin Core releases

Discovery Timeline

• 2025-10-24 - Bitcoin Core project publishes coordinated CVE disclosure
• 2025-10-28 - CVE-2025-54605 published to the National Vulnerability Database
• 2025-11-07 - Last updated in NVD database

Technical Details for CVE-2025-54605

Vulnerability Analysis

The vulnerability stems from improper enforcement of resource limits within Bitcoin Core through version 29.0. An attacker can interact with an exposed node over the network and trigger conditions that consume excessive resources. Because Bitcoin Core nodes accept inbound peer-to-peer connections by default, remote attackers can reach the vulnerable code paths without prior authentication or user interaction. The Bitcoin Core maintainers have categorized this as the second of two related uncontrolled resource consumption issues disclosed in the same advisory cycle. Detailed root cause information is intentionally withheld in the public advisory to allow node operators time to upgrade. Refer to the Bitcoin Core CVE Disclosure for the maintainers' authoritative description.

Root Cause

The underlying weakness is mapped to CWE-400: Uncontrolled Resource Consumption. The affected code paths do not adequately bound the amount of memory, CPU, or other resources consumed when processing attacker-influenced inputs. Without bounded consumption, repeated or crafted requests amplify resource usage until the node degrades or becomes unresponsive.

Attack Vector

The attack vector is network-based with low complexity and requires no privileges or user interaction. An attacker connects to a reachable Bitcoin Core node and sends crafted protocol messages or sequences that the node processes without sufficient resource constraints. Public-facing nodes, mining pool infrastructure, exchange backends, and wallet service nodes are the most exposed targets. The Bitcoin Core advisory should be consulted for the precise message types and conditions involved.

No verified public proof-of-concept code is currently available. The vulnerability mechanism is described in prose because no sanitized exploit code has been released by the Bitcoin Core project. See the Bitcoin Common Vulnerabilities Page for historical context on similar resource exhaustion issues.

Detection Methods for CVE-2025-54605

Indicators of Compromise

• Sudden spikes in memory or CPU utilization on bitcoind processes without corresponding increases in legitimate transaction or block throughput.
• Unusually high inbound peer connection counts or repeated connections from a small set of remote IP addresses.
• Node logs showing degraded peer message processing, dropped peers, or out-of-memory conditions.
• Loss of synchronization with the Bitcoin network or extended block validation times.

Detection Strategies

• Monitor bitcoind resource consumption baselines and alert on deviations correlated with inbound P2P traffic volume.
• Review Bitcoin Core debug logs (debug.log) for repeated peer misbehavior events or message handler errors.
• Correlate network flow data with node performance metrics to identify abusive peers targeting port 8333.

Monitoring Recommendations

• Deploy host-based monitoring to track memory growth, file descriptor usage, and CPU saturation on nodes running Bitcoin Core.
• Use network telemetry to baseline normal P2P connection patterns and flag anomalous inbound connection bursts.
• Aggregate node logs into a centralized analytics platform to enable cross-node correlation of abuse patterns.

How to Mitigate CVE-2025-54605

Immediate Actions Required

• Upgrade Bitcoin Core to the latest patched release published after the October 24, 2025 disclosure. Refer to the GitHub Bitcoin Release Notes for the fixed version.
• Inventory all internal and external nodes running Bitcoin Core 29.0 or earlier and prioritize public-facing systems for patching.
• Restrict inbound peer connections on untrusted interfaces until the upgrade is complete.

Patch Information

The Bitcoin Core project addressed CVE-2025-54605 in releases following the October 24, 2025 coordinated disclosure. Node operators should obtain signed binaries or source from the official Bitcoin Core release page and verify signatures before deployment. The Bitcoin Core CVE Disclosure identifies the specific fixed version.

Workarounds

• Limit inbound peer connections using the -maxconnections configuration option to reduce exposure on internet-facing nodes.
• Restrict P2P port 8333 access at the firewall to known peer ranges where feasible.
• Use -whitelist and -bind options to constrain which interfaces and peers can interact with the node.
• Disable unauthenticated public RPC and apply network ACLs in front of node infrastructure.

# Configuration example: bitcoin.conf hardening while upgrading
maxconnections=40
listen=1
bind=127.0.0.1
rpcbind=127.0.0.1
rpcallowip=127.0.0.1