Vulnerability · Published Nov 7, 2022 · Assigned by mitre
CVE-2022-44797
Critical 9.8
In plain English
A critical-severity security flaw in the github.com/btcsuite/btcd package (Go). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 75% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)1.6%top 24.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
btcd before 0.23.2, as used in Lightning Labs lnd before 0.15.2-beta and other Bitcoin-related products, mishandles witness size checking.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/btcsuite/btcd | 0.23.2 | GHSA-2chg-86hq-7w38 |
| Go | github.com/btcsuite/btcd | 0.23.2 | GO-2022-1098 |
| Go | github.com/lightningnetwork/lnd | 0.15.2-beta | GHSA-2chg-86hq-7w38 |
| Ubuntu:22.04:LTS | golang-github-btcsuite-btcd-btcec | no fix listed | UBUNTU-CVE-2022-44797 |
| Ubuntu:24.04:LTS | golang-github-btcsuite-btcd-btcec | no fix listed | UBUNTU-CVE-2022-44797 |
| Ubuntu:25.10 | golang-github-btcsuite-btcd-btcec | no fix listed | UBUNTU-CVE-2022-44797 |
| Ubuntu:26.04:LTS | golang-github-btcsuite-btcd-btcec | no fix listed | UBUNTU-CVE-2022-44797 |