CVE-2025-46598

CVE-2025-46598 describes a CPU Denial-of-Service (DoS) vulnerability affecting Bitcoin Core, stemming from the processing of unconfirmed transactions. An attacker could exploit this by sending specially crafted, non-standard unconfirmed transactions. While these transactions would ultimately be rejected by a victim node, each validation attempt would consume several seconds of CPU time without causing a disconnection, allowing the attacker to repeatedly send such transactions. This continuous processing of resource-intensive, unconfirmed transactions could be leveraged to delay block propagation within the Bitcoin network. Mitigations were implemented to reduce the validation time in various Script contexts, and a fix for this issue was released on October 10, 2025, in Bitcoin Core version 30.0.