CVE-2018-17145

Bitcoin Core 0.16.x before 0.16.2 and Bitcoin Knots 0.16.x before 0.16.2 allow remote denial of service via a flood of multiple transaction inv messages with random hashes, aka INVDoS. NOTE: this can also affect other cryptocurrencies, e.g., if they were forked from Bitcoin Core after 2017-11-15.

• CWE-400

• https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures#CVE-2018-17145Vendor Advisory
• https://github.com/bitcoin/bitcoin/blob/v0.16.2/doc/release-notes.mdRelease Notes, Third Party Advisory
• https://invdos.netThird Party Advisory
• https://invdos.net/paper/CVE-2018-17145.pdfExploit, Technical Description, Third Party Advisory
• https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures#CVE-2018-17145Vendor Advisory
• https://github.com/bitcoin/bitcoin/blob/v0.16.2/doc/release-notes.mdRelease Notes, Third Party Advisory
• https://invdos.netThird Party Advisory
• https://invdos.net/paper/CVE-2018-17145.pdfExploit, Technical Description, Third Party Advisory

Published

Sep 10, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-17139UltimatePOS 2.5 allows users to upload arbitrary files, whic…
• CVE-2018-17140The Quizlord plugin through 2.0 for WordPress is prone to St…
• CVE-2018-17141HylaFAX 6.0.6 and HylaFAX+ 5.6.0 allow remote attackers to e…
• CVE-2018-17142The html package (aka x/net/html) through 2018-09-17 in Go m…7.5
• CVE-2018-17143The html package (aka x/net/html) through 2018-09-17 in Go m…7.5
• CVE-2018-17144Bitcoin Core 0.14.x before 0.14.3, 0.15.x before 0.15.2, and…7.5
• CVE-2018-17146A cross-site scripting vulnerability exists in Nagios XI bef…
• CVE-2018-17147Nagios XI before 5.5.4 has XSS in the auto login admin manag…
• CVE-2018-17148An Insufficient Access Control vulnerability (leading to cre…
• CVE-2018-1715IBM Maximo Asset Management 7.6 through 7.6.3 is vulnerable …5.4
• CVE-2018-17150Intersystems Cache 2017.2.2.865.0 allows XSS.
• CVE-2018-17151Intersystems Cache 2017.2.2.865.0 has Incorrect Access Contr…