CVE-2024-34478 json
btcd susceptible to consensus failures
published 2024-05-05 2 y ago modified 2026-06-17 4 mo ago also GHSA-3jgf-r68h-xfqm , GO-2024-2818 , EUVD-2024-1391
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 46%
- public exploits
- 0
- none known
Summary
btcd before 0.24.0 does not correctly implement the consensus rules outlined in BIP 68 and BIP 112, making it susceptible to consensus failures. Specifically, it uses the transaction version as a signed integer when it is supposed to be treated as unsigned. There can be a chain split and loss of funds.
Patch / fix
- go github.com/btcsuite/btcd 0.24.0
- btcd btcd 0.24.0
- github.com/btcsuite/btcd@253b688 commit
- github.com/btcsuite/btcd#1981 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.56% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/btcsuite/btcd | <0.24.0 |
0.24.0 |
Affected products
- btcd btcd
Classification
- Weakness
-
- CWE-436 Interpretation Conflict
References
-
github.com
/btcsuite/btcd/pull/1981
web, patch
-
github.com
/btcsuite/btcd/commit/253b688c68b89eca7eb75d4d5443dbdbc928db3c
web
-
delvingbitcoin.org
/t/disclosure-btcd-consensus-bugs-due-to-usage-of-signed-transaction-version/455
web, issue-tracking
-
github.com
/btcsuite/btcd/blob/e4c88c3a3ecb1813529bf3dddc7a865bd418a6b8/blockchain/chain.go#L383C1-L392C3
web, product
-
github.com
/btcsuite/btcd/blob/e4c88c3a3ecb1813529bf3dddc7a865bd418a6b8/txscript/opcode.go#L1172C1-L1178C3
web, product
-
nvd.nist.gov
/vuln/detail/CVE-2024-34478
advisory
-
github.com
/btcsuite/btcd
package
-
pkg.go.dev
/vuln/GO-2024-2818
web
Sources
- CVE List CVE-2024-34478
- GitHub Advisory GHSA-3jgf-r68h-xfqm
- NVD CVE-2024-34478
- OSV GO-2024-2818
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.