{"id":"CVE-2026-117346","kind":"vulnerability","aliases":["CVE-2026-117346"],"related":[],"title":"Bitcoin Core: undo files have no size limit, enabling denial of service","description":"Bitcoin Core through 31.1 is vulnerable to Denial of Service via undo files having no size limit","summary":"Bitcoin Core through version 31.1 does not limit the size of undo files it reads. An attacker can make the node consume excessive resources and stop working.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bitcoin-core","bitcoin-node","runtime"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-30T15:16:46+00:00","first_seen_at":"2026-10-30T15:31:09+00:00","triaged_at":"2026-10-30T15:33:56+00:00","updated_at":"2026-10-30T15:33:56+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-30T15:33:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Bitcoin Core: undo files have no size limit, enabling denial of service","impact":"low","summary":"Bitcoin Core through version 31.1 does not limit the size of undo files it reads. An attacker can make the node consume excessive resources and stop working.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["bitcoin-core","bitcoin-node"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Node becomes unavailable through resource exhaustion from oversized undo files","analyst_note":"Sources give only the NVD description; check the NVD entry and Bitcoin Core release notes for the fixed version, trigger conditions and whether an attacker needs network access.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000589,"input_tokens":4052,"output_tokens":368,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117346':15A,18A '-2026':14A,17A '31.1':30B,56C 'attack':42B 'bitcoin':1A,20B,23B,26B,53C 'bitcoin-cor':19B 'bitcoin-nod':22B 'consum':47B 'core':2A,21B,27B,54C 'cve':13A,16A 'denial':10A,60C 'enabl':9A 'excess':48B 'file':4A,38B,65C 'limit':8A,33B,69C 'make':44B 'node':24B,46B 'read':40B 'resourc':49B 'runtim':25B 'servic':12A,62C 'size':7A,35B,68C 'stop':51B 'undo':3A,37B,64C 'version':29B 'via':63C 'vulner':58C 'work':52B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T15:16:46+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117346","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117346","severity":null,"published_at":"2026-10-30T15:16:46+00:00","modified_at":"2026-10-30T15:16:46+00:00","first_seen_at":"2026-10-30T15:31:09+00:00","fetched_at":"2026-10-30T15:31:09+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}