Core

Bitcoin

April

Read

would

<p><strong>Bitcoin Core developers disclosed a high-severity bug that could allow miners to remotely crash some Bitcoin nodes.&nbsp;</strong></p>
<div id="cn-block-summary-block_241a08f6dcd56e2af4c90ab19f7daf7d" class="cn-block-summary">
 <div class="cn-block-summary__nav tabs"><span>Summary</span>
 </div>
 <div class="cn-block-summary__content">
  <ul>
   <li>Bitcoin Core disclosed CVE-2024-52911, affecting versions before 29.0, with older nodes still exposed online.</li>
   <li>Miners needed costly proof-of-work blocks to trigger crashes, making real-world abuse historically unlikely for attackers.</li>
   <li>Cory Fields privately reported the bug in 2024, before Bitcoin Core 29.0 shipped patched software.</li>
  </ul>
 </div>
</div>
<p>The issue, tracked as CVE-2024-52911, affected Bitcoin Core versions after 0.14.0 and before 29.0. The bug was fixed in Bitcoin Core 29.0, which was released in April 2025.&nbsp;</p>
<p>Bitcoin Core made the <a href="https://bitcoincore.org/en/2026/05/05/disclose-cve-2024-52911/" rel="noopener noreferrer nofollow">issue</a> public on May 5, 2026, after the final vulnerable 28.x release line reached end of life on April 19.</p>
<p>You might also like: <a href="https://crypto.news/bitcoin-rally-loses-steam-at-81k-following-trumps-pause-on-project-freedom/" rel="noopener noreferrer nofollow"> Bitcoin rally loses steam at $81K following Trump’s pause on ‘Project Freedom’ </a></p>
<h2 class="wp-block-heading" id="strong-bug-affected-block-validation-strong"><strong>Bug affected block validation</strong></h2>
<p>The issue involved Bitcoin Core’s script interpreter during block validation. Bitcoin Core said a specially crafted block could cause a node to access memory after that data had already been freed.</p>
<p>During validation, Bitcoin Core pre-calculates transaction input data and sends script checks to background threads. In some cases, an invalid block could destroy cached data while another thread still tried to read it.</p>
<p>Bitcoin Core said this could allow an attacker with enough proof-of-work to crash victim nodes. It also said “it is possible” the crash could support remote code execution, though limits on block data made that outcome “unlikely.”</p>
<h2 class="wp-block-heading" id="strong-attack-required-costly-mining-strong"><strong>Attack required costly mining</strong></h2>
<p>The attack was not simple to carry out. A miner would need to produce a specially crafted block with enough proof-of-work to reach the chain tip.</p>
<p>That made the attack costly because such a block would be invalid. It could not earn a normal block reward, leaving the attacker to spend hashpower without collecting the usual mining payout.</p>
<p>Bitcoin Core did not say the bug had been used in real attacks. The advisory focused on the flaw, the fix, and the disclosure timeline.</p>
<p>The bug did not change Bitcoin’s consensus rules. It was tied to memory handling in Bitcoin Core software, not the rules that define valid Bitcoin transactions or blocks.</p>
<h2 class="wp-block-heading" id="strong-cory-fields-reported-the-flaw-strong"><strong>Cory Fields reported the flaw</strong></h2>
<p>Cory Fields of the MIT Digital Currency Initiative privately reported the bug on Nov. 2, 2024. Bitcoin Core said the report included a proof of concept and a proposed way to reduce the risk.</p>
<p>Pieter Wuille pushed a covert fix four days later through PR 31112. The pull request was merged on Dec. 3, 2024, before Bitcoin Core 29.0 shipped with the fix in April 2025.</p>
<p>The advisory followed Bitcoin Core’s disclosure policy for high-severity bugs. Its policy says high-severity issues are disclosed after the last affected release goes end of life.</p>
<p>In addition, node operators using Bitcoin Core versions before 29.0 still face the old bug. Bitcoin Core does not auto-update, so users must install newer versions manually.</p>
<p>A past <a href="https://crypto.news/trail-bits-blockchains-decentralized/?" rel="noopener noreferrer nofollow">report</a> on blockchain decentralization risks cited research that 21% of Bitcoin nodes ran outdated Bitcoin Core software in June 2021. That context shows why older client versions can remain a security concern long after fixes ship.</p>
<p>Read more: <a href="https://crypto.news/a16z-launches-2-2b-crypto-fund-to-back-stablecoins-tokenized-assets/" rel="noopener noreferrer nofollow"> a16z launches $2.2B crypto fund to back stablecoins, tokenized assets </a></p>

Bitcoin Core discloses bug that could let miners crash nodes

Table of Contents

crypto.news

Other articles published on May 6, 2026

Join our free newsletter for daily crypto updates!