What is the CVSS score of CVE-2025-46598?

CVE-2025-46598 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of N A are affected by CVE-2025-46598?

Organizations using Core should be aware of moderate risk from CVE-2025-46598 rated CVSS 5.3. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2025-46598?

Within 30 days: Identify affected systems running Core and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

N A CVE-2025-46598

EUVD-2025-208889 MEDIUM

Asymmetric Resource Consumption (Amplification) (CWE-405)

2026-03-20 mitre

Denial Of Service N A

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 20, 2026 - 15:15 euvd

EUVD-2025-208889

Analysis Generated

Mar 20, 2026 - 15:15 vuln.today

CVE Published

Mar 20, 2026 - 00:00 nvd

MEDIUM 5.3

DescriptionCVE.org

Bitcoin Core through 29.0 allows a denial of service via a crafted transaction.

AnalysisAI

Bitcoin Core versions through 29.0 contain a denial of service vulnerability that can be triggered by a specially crafted transaction. An attacker with network access can send a malicious transaction to cause the affected Bitcoin Core node to become unresponsive or crash, disrupting normal operation of the node. No CVSS score, EPSS data, or active exploitation in the wild has been disclosed, but the vulnerability has been formally disclosed by the Bitcoin Core project.

Technical ContextAI

Bitcoin Core is the reference implementation of the Bitcoin protocol, written in C++, and handles the validation, relay, and storage of blockchain transactions. The vulnerability exists in the transaction processing logic and can be triggered by a crafted transaction that exploits improper input validation or resource handling within the transaction validation or mempool management subsystem. The root cause appears to be related to improper handling of transaction inputs that allows an attacker to exhaust resources (CPU, memory, or locks) on a target node. This class of vulnerability typically falls under improper input validation or resource exhaustion categories (CWE-400 or similar), though the specific CWE has not been disclosed by the vendor.

RemediationAI

Immediately upgrade Bitcoin Core to a patched version released after October 24, 2025. Check the official Bitcoin Core GitHub releases page (https://github.com/bitcoin/bitcoin/releases) and the security advisory (https://bitcoincore.org/en/2025/10/24/disclose-cve-2025-46598/) for the recommended minimum version. If immediate patching is not possible, implement network-layer mitigations such as restricting inbound peer connections to trusted nodes only, using a reverse proxy or firewall to rate-limit or block suspicious transaction patterns, and monitoring node logs for signs of resource exhaustion or crashes. For critical infrastructure, consider temporarily running multiple redundant nodes with staggered upgrades to maintain availability during the patching window.