---
id: "CVE-2026-117346"
kind: "vulnerability"
aliases: ["CVE-2026-117346"]
title: "Bitcoin Core: undo files have no size limit, enabling denial of service"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["bitcoin-core", "bitcoin-node", "runtime"]
not_affected_if: []
published_at: "2026-10-30T15:16:46+00:00"
first_seen_at: "2026-10-30T15:31:09+00:00"
updated_at: "2026-10-30T15:33:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117346", "first_seen_at": "2026-10-30T15:31:09+00:00"}]
---

# Bitcoin Core: undo files have no size limit, enabling denial of service

Bitcoin Core through version 31.1 does not limit the size of undo files it reads. An attacker can make the node consume excessive resources and stop working.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-30T15:31:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117346

## From the sources

Bitcoin Core through 31.1 is vulnerable to Denial of Service via undo files having no size limit

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_