CVE-2023-50428

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-12-09 · updated 2026-06-17

Description

In Bitcoin Core through 26.0 and Bitcoin Knots before 25.1.knots20231115, datacarrier size limits can be bypassed by obfuscating data as code (e.g., with OP_FALSE OP_IF), as exploited in the wild by Inscriptions in 2022 and 2023. NOTE: although this is a vulnerability from the perspective of the Bitcoin Knots project, some others consider it "not a bug."

Affected products

Bitcoin Core: from 0.9 through 26.0
Bitcoinknots Bitcoin Knots: from 0.9 before 25.1 — fixed in 25.1

How to fix

Upgrade to a fixed version: Bitcoinknots Bitcoin Knots 25.1. Check the vendor advisory for mitigations.

References

https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures
https://github.com/bitcoin/bitcoin/blob/65c05db660b2ca1d0076b0d8573a6760b3228068/src/kernel/mempool_options.h#L46-L53
https://github.com/bitcoin/bitcoin/pull/28408#issuecomment-1844981799
https://github.com/bitcoin/bitcoin/tags
https://github.com/bitcoinknots/bitcoin/blob/aed49ce8989334c364a219a6eb016a3897d4e3d7/doc/release-notes.md
https://twitter.com/LukeDashjr/status/1732204937466032285
https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures
https://github.com/bitcoin/bitcoin/blob/65c05db660b2ca1d0076b0d8573a6760b3228068/src/kernel/mempool_options.h#L46-L53
https://github.com/bitcoin/bitcoin/pull/28408#issuecomment-1844981799
https://github.com/bitcoin/bitcoin/tags
https://github.com/bitcoinknots/bitcoin/blob/aed49ce8989334c364a219a6eb016a3897d4e3d7/doc/release-notes.md
https://twitter.com/LukeDashjr/status/1732204937466032285

Get alerted when CVE-2023-50428 or the next vulnerability affects your stack