CVE-2026-117346 in Bitcoin
Summary
by MITRE • 10/30/2026
Bitcoin Core through 31.1 is vulnerable to Denial of Service via undo files having no size limit
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in Bitcoin Core versions up to and including 31.1 represents a significant resource exhaustion flaw rooted in the handling of blockchain state data, specifically within the mechanism used for storing undo information. In the architecture of Bitcoin Core, when blocks are added to the local copy of the blockchain, the software must maintain an index that allows it to reverse or undo these changes if they become part of a forked chain that is no longer considered valid by the network consensus rules. This reversal process relies on undo files which contain the data necessary to revert state changes made by specific blocks. The core technical flaw lies in the absence of strict size constraints or limits applied to these undo file structures during their creation and management phases.
From a technical perspective, this lack of enforcement allows an attacker who can influence the blockchain structure or interact with the node's synchronization process to trigger the generation of excessively large undo files. By manipulating block data or exploiting specific edge cases in how the database backend handles incremental writes for these undo records, it is possible to cause the system to allocate disproportionate amounts of disk space and memory resources. The vulnerability essentially stems from a failure to implement proper input validation regarding resource consumption limits, which aligns with CWE-789: Uncontrolled Memory Allocation or CWE-400: Uncontrolled Resource Consumption depending on whether the primary impact is RAM exhaustion via object creation or disk saturation through file growth.
The operational impact of this vulnerability is severe for node operators and network participants who rely on Bitcoin Core to validate transactions and maintain a full copy of the ledger. An attacker capable of exploiting this flaw can induce a Denial of Service condition by forcing the affected node to consume all available storage space or memory resources dedicated to handling undo data. This resource exhaustion leads to the application becoming unresponsive, crashing, or being forced into an emergency shutdown state to prevent further damage to the underlying operating system. For mining pools and exchanges that depend on continuous uptime for real-time transaction processing, such instability can result in significant financial losses due to missed blocks or delayed confirmations.
This type of vulnerability is often categorized under attack vectors where a remote actor sends crafted data or triggers specific synchronization paths to overwhelm local resources. In the context of the MITRE ATT&CK framework, this behavior corresponds to techniques associated with Resource Hijacking and Denial of Service, specifically targeting infrastructure availability rather than confidentiality or integrity directly. The exploitation does not require authentication but may depend on the node being exposed to untrusted peers during block synchronization, making it particularly dangerous for publicly accessible full nodes that process blocks from unknown sources without sufficient filtering mechanisms in place.
Mitigation strategies primarily involve upgrading to a patched version of Bitcoin Core where developers have implemented strict limits on undo file sizes and introduced safeguards against excessive resource allocation during state reversals. Administrators should also consider implementing network-level controls such as rate limiting for incoming block announcements and configuring firewall rules to restrict connections from untrusted peers if possible. Additionally, monitoring disk usage and memory consumption patterns can help detect early signs of exploitation attempts before they lead to a complete service outage. Regular updates and adherence to best practices for node security configuration are essential defenses against this class of resource exhaustion vulnerabilities in distributed ledger technologies.