CVE-2018-17145: Bcoin

High severity, CVSS 7.5. EPSS: 4.1% chance of exploitation in the next 30 days.

Bitcoin Core 0.16.x before 0.16.2 and Bitcoin Knots 0.16.x before 0.16.2 allow remote denial of service via a flood of multiple transaction inv messages with random hashes, aka INVDoS. NOTE: this can also affect other cryptocurrencies, e.g., if they were forked from Bitcoin Core after 2017-11-15.

Affected products

• Bcoin Bcoin: before 1.0.2 (fixed in 1.0.2)
• Bitcoin Bitcoin Core: from 0.16.0, before 0.16.2 (fixed in 0.16.2)
• Bitcoinknots Bitcoin Knots: from 0.16.0, before 0.16.2 (fixed in 0.16.2)
• Btcd Project Btcd: version 0.3.0 only; version 0.3.1 only; version 0.3.2 only; version 0.3.3 only; version 0.4.0 only; version 0.5.0 only; …
• Decred Dcrd: before 1.5.2 (fixed in 1.5.2)
• Litecoin Litecoin: from 0.16.0, before 0.16.2 (fixed in 0.16.2)
• Namecoin Namecoin Core: from 0.16.0, before 0.16.2 (fixed in 0.16.2)

Published 2020-09-10. Last modified 2026-06-17.