CVE-2025-54605: Bitcoin Core DOS Vulnerability

CVE-2025-54605 Overview

CVE-2025-54605 is an uncontrolled resource consumption vulnerability affecting Bitcoin Core through version 29.0. The flaw is the second of two related resource consumption issues disclosed by the Bitcoin Core project on October 24, 2025. A remote, unauthenticated attacker can trigger excessive resource usage against a running Bitcoin Core node, degrading availability of the affected process. The weakness is classified under CWE-400: Uncontrolled Resource Consumption and impacts the availability of Bitcoin full nodes that participate in the peer-to-peer network.

Critical Impact
Remote attackers can exhaust resources on Bitcoin Core nodes through 29.0 without authentication or user interaction, leading to denial of service.

Affected Products

Bitcoin Core versions up to and including 29.0
Bitcoin full node operators running vulnerable releases
Downstream forks and distributions based on Bitcoin Core 29.0 or earlier

Discovery Timeline

2025-10-24 - Bitcoin Core project publishes CVE disclosure advisory
2025-10-28 - CVE-2025-54605 published to NVD
2025-11-07 - Last updated in NVD database

Technical Details for CVE-2025-54605

Vulnerability Analysis

The vulnerability is an uncontrolled resource consumption flaw in Bitcoin Core through 29.0. According to the project's disclosure, this is the second of two related resource consumption issues remediated in the same coordinated release. The defect allows a network-reachable adversary to provoke disproportionate CPU, memory, bandwidth, or storage consumption on the target node by sending crafted protocol traffic.

Bitcoin Core nodes accept inbound peer connections by default and process incoming peer messages without prior authentication. When the affected code path handles attacker-influenced input, the node consumes resources beyond expected bounds. Sustained exploitation can degrade block validation, mempool maintenance, and peer relay functions on the node.

The issue affects only availability. Confidentiality and integrity of the blockchain are not impacted because consensus rules and cryptographic validation remain enforced. The Bitcoin Core project addresses this issue alongside CVE-2025-54604 in the patched release. See the Bitcoin Core CVE Disclosure for vendor-confirmed details.

Root Cause

The root cause is missing or insufficient limits on a resource-consuming operation invoked by network input. Under [CWE-400], the software does not adequately bound the resources allocated or consumed during processing of attacker-controlled data. Specific code paths and bounds have not been published by the project to limit exploit development before broad upgrade adoption.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker connects to a Bitcoin Core node over the standard peer-to-peer port and sends protocol messages that trigger the unbounded resource path. Because Bitcoin Core nodes commonly expose inbound connectivity for network participation, exposure is broad across publicly reachable nodes.

The vulnerability mechanism is described in prose because no public proof-of-concept has been released. Refer to the Bitcoin Core CVE Disclosure and Bitcoin GitHub Release Notes for technical specifics as they are published.

Detection Methods for CVE-2025-54605

Indicators of Compromise

Sudden spikes in CPU, memory, or bandwidth utilization on bitcoind or Bitcoin Core GUI processes without corresponding block or transaction volume
Repeated disconnections, peer eviction events, or unresponsive RPC interfaces on a node
Inbound peer connections from previously unseen IP addresses immediately preceding resource exhaustion
Log entries indicating message processing stalls or queue backpressure in debug.log

Detection Strategies

Monitor process-level resource metrics for bitcoind and alert on sustained deviation from baseline
Inspect Bitcoin Core debug.log for warnings about peer behavior, banning, or message rate limits
Track the count and origin of inbound P2P connections using the getpeerinfo RPC method
Correlate node availability incidents with network-level flow data to identify abusive peers

Monitoring Recommendations

Collect Bitcoin Core logs and host telemetry into a centralized analytics platform for correlation
Establish baselines for normal peer message rates and resource consumption per node
Alert on abrupt changes in mempool size, message queue depth, or peer churn
Review firewall and intrusion detection logs for high-volume traffic targeting the P2P port (default 8333)

How to Mitigate CVE-2025-54605

Immediate Actions Required

Upgrade Bitcoin Core to the fixed release identified in the Bitcoin Core CVE Disclosure as soon as feasible
Inventory all hosts running bitcoind or Bitcoin Core GUI and confirm versions against the advisory
Restrict inbound P2P connectivity to trusted peers where operationally acceptable
Enable host and network monitoring to detect resource exhaustion attempts during patch rollout

Patch Information

The Bitcoin Core project released a coordinated fix on October 24, 2025. Operators should consult the Bitcoin GitHub Release Notes for the exact fixed version and upgrade instructions. The advisory at bitcoincore.org is the authoritative source for affected and remediated versions.

Workarounds

Limit inbound peer connections using the -maxconnections configuration option to reduce attack surface
Use -whitelist and -onlynet settings to restrict peering to known, trusted endpoints
Place nodes behind firewall rules that rate-limit or block traffic on TCP port 8333 from untrusted sources
Run nodes with resource control mechanisms such as cgroups or container limits to contain resource exhaustion impact

bash

# Configuration example: bitcoin.conf hardening
maxconnections=40
maxuploadtarget=5000
listen=1
bind=127.0.0.1
whitelist=192.0.2.0/24