bitcoinj: ScriptExecution P2PKH/P2WPKH Verification Bypass
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-347.
Summary
The bitcoinj library is a Java implementation of the Bitcoin protocol. Prior to 0.17.1, ScriptExecution.correctlySpends() contains two fast-path verification bugs for standard P2PKH and native P2WPKH spends in core/src/main/java/org/bitcoinj/script/ScriptExecution.java. In both branches, bitcoinj verifies an attacker-controlled signature/public-key pair but fails to verify that the public key is the one committed to by the output being spent. As a result, any attacker keypair can satisfy bitcoinj's local verification for arbitrary P2PKH and P2WPKH outputs. This vulnerability is fixed in 0.17.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| bitcoinj | bitcoinj | before 0.17.1 | 0.17.1 | Patch available | CNA |
| — | org.bitcoinj:bitcoinj-core (Maven) | 0.15 to before 0.17.1 | 0.17.1 | Patch available | GHSA-hfcf-v2f8-x9pc |
- bitcoinj Vendorbitcoinj Affected before 0.17.1 Fixed in 0.17.1 Patch available CNA
- org.bitcoinj:bitcoinj-core (Maven) Vendor— Affected 0.15 to before 0.17.1 Fixed in 0.17.1 Patch available GHSA-hfcf-v2f8-x9pc
Remediation
- Fix · CNA bitcoinj (bitcoinj) Fixed in 0.17.1
- Fix · GHSA-hfcf-v2f8-x9pc org.bitcoinj:bitcoinj-core (Maven) Fixed in 0.17.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-44714
- 2026-10-03 Alias added: GHSA-hfcf-v2f8-x9pc
References
Other 5
- https://github.com/bitcoinj/bitcoinj/security/advisories/GHSA-hfcf-v2f8-x9pc
- https://github.com/bitcoinj/bitcoinj/commit/2bc5653c41d260d840692bc554690d4d79208f9c
- https://github.com/bitcoinj/bitcoinj/commit/b575a682acf614b9ff95cacbdeb48f86c3ababe0
- https://github.com/bitcoinj/bitcoinj
- https://github.com/bitcoinj/bitcoinj/releases/tag/v0.17.1
Sources
- CVE-2026-44714 · CVE Program
- CVE-2026-44714 · NVD
- FIRST EPSS
- GHSA-hfcf-v2f8-x9pc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences