CVE-2025-54605: 
Bitcoin Core vulnerability analysis and mitigation

CVE-2025-54605 is an Uncontrolled Resource Consumption vulnerability (issue 2 of 2) in Bitcoin Core, affecting all versions through 29.0. It was publicly disclosed on October 28, 2025, with a patch advisory published by Bitcoin Core on October 24, 2025. The vulnerability carries a CVSS v3.1 base score of 7.5 (High), reflecting its network-exploitable, unauthenticated denial-of-service potential (Feedly, Bitcoin Core Advisory).

The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption), meaning the software fails to properly limit the amount of resources it allocates in response to network input. An unauthenticated remote attacker can send specially crafted network messages to a vulnerable Bitcoin Core node, causing it to consume excessive system resources and potentially crash or become unresponsive. No user interaction is required, and the attack vector is entirely network-based. This is the second of two related resource consumption issues disclosed simultaneously (the companion being CVE-2025-54604) (Bitcoin Core Advisory, Feedly).

Successful exploitation results in a high availability impact — a vulnerable Bitcoin Core node can be rendered unresponsive or crashed by a remote, unauthenticated attacker, disrupting participation in the Bitcoin peer-to-peer network. There is no confidentiality or integrity impact associated with this vulnerability. Node operators running affected versions risk service disruption, which could affect transaction relay, block propagation, and wallet functionality for those relying on the node (Feedly, Bitcoin Core Advisory).

There is no public proof-of-concept exploit code known at this time, and no evidence of in-the-wild exploitation has been reported. The EPSS score is approximately 0.017%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been made (Feedly).

The primary remediation is to upgrade Bitcoin Core to version 30.0 or later, which contains the fix for this vulnerability (Bitcoin Core Advisory, GitHub Releases). As interim measures, operators should implement network-level filtering to restrict potentially malicious traffic to the node's P2P port, monitor system resource consumption for anomalies, and configure firewalls to limit exposure to untrusted peers. Regularly updating Bitcoin Core installations is strongly recommended as a general security practice.

The disclosure was covered by cryptocurrency-focused media outlets, with Bitcoin Ethereum News noting that Bitcoin Core disclosed four low-severity vulnerabilities addressed in the v30.0 release (Bitcoin Ethereum News). Community discussion on Bitcoin Stack Exchange raised questions about whether fixes for CVE-2025-54604, CVE-2025-54605, and related CVEs had been backported to the 29.x or 28.x release branches (Bitcoin Stack Exchange). General community sentiment treated the issue as a routine maintenance disclosure given its low-to-medium severity classification.