CVE-2019-25220: 
Bitcoin Core vulnerability analysis and mitigation

Bitcoin Core before 24.0.1 was discovered to be vulnerable to a denial of service (daemon crash) attack known as the 'Chain Width Expansion' attack. The vulnerability allows remote attackers to cause a node crash by flooding it with low-difficulty header chains, exploiting the fact that nodes did not verify that a presented chain has enough work before committing to store it (Bitcoin Core, NVD).

The vulnerability stems from Bitcoin Core's implementation of blockchain header storage in memory. The issue was that nodes would store header chains without first verifying their proof-of-work difficulty, making them susceptible to being overwhelmed with extremely long chains of low-difficulty headers. Once crafted, an attack chain could be reused to crash any node on the network. The attack's cost has decreased significantly over time - from 32.28% of mining one block in 2019 to just 4.44% by 2024, making it increasingly economically viable for attackers (Bitcoin Core).

The vulnerability allows attackers to cause a denial of service by crashing Bitcoin Core daemon processes through memory exhaustion. This could potentially disrupt network operations by taking nodes offline. The attack is particularly concerning because once an attack chain is created, it can be reused against multiple nodes, making it an efficient vector for network disruption (Bitcoin Core).

The vulnerability was fixed in Bitcoin Core version 24.0.1, which implemented a protection mechanism that verifies a presented chain has enough work before committing to store it. This fix eliminates the need for checkpoint-based protection that was previously used to mitigate similar attacks. Users are advised to upgrade to Bitcoin Core version 24.0.1 or later to protect against this vulnerability (Bitcoin Core).

The vulnerability was initially discovered and reported to the Bitcoin Core project in January 2019 by David Jaenson, who suggested introducing newer checkpoints as a mitigation. It gained more attention when Braydon Fuller posted his 'Chain width expansion' analysis to the bitcoin-dev mailing list in October 2019. The suggested approach was initially not adopted due to concerns about network convergence (Bitcoin Core).