> CVE-2025-65548

« BACK_TO_HOME
PUBLISHED
2025-12-08 19:15
MODIFIED
2025-12-08 19:15
EPSS (Prob. Exploit)
0.42%
Top 63.8%
DATA SOURCES:
NVD 🔗 2025-12-08 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-11-08 OSV 🔗 2026-11-08

> DESCRIPTION

NUT-14 allows cashu tokens to be created with a preimage hash. However, nutshell (cashubtc/nuts) before 0.18.0 do not validate the size of preimage when the token is spent. The preimage is stored by the mint and attacker can exploit this vulnerability to fill the mint's db nd disk with arbitrary data.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

AFFECTED PACKAGES:
Unknown / Unknown
26 versions affected
ALIASES:
PYSEC-2025-89

> HISTORIQUE DES MODIFICATIONS

Première apparition
08/12/2025 19:15
Source: NVD
📊 ENRICHISSEMENT 19/01/2026 17:37
CVEPROJECT
Champ modifié: CVE Project
Ancienne valeur:
Non
Nouvelle valeur:
Oui
Total des modifications: 1 Dernière mise à jour: 9 months ago

> REFERENCES

https://bitcointalk.org/index.php?topic=5564329
https://delvingbitcoin.org/t/public-disclosure-denial-of-service-using-htlc-in-c...
https://github.com/cashubtc/nuts/blob/main/07.md
https://github.com/cashubtc/nuts/blob/main/14.md
https://github.com/jamesob/delving-bitcoin-archive/blob/master/archive/rendered-...
https://preimage007.github.io/
« BACK_TO_HOME