Bitcoin Core versions up to and including 31.1 are vulnerable to a denial of service attack triggered by undo files with no size limit. Because the software does not enforce an upper bound, an attacker may cause disk or memory exhaustion by creating or manipulating large undo files, leading to a node outage. The vulnerability is a classic instance of uncontrolled resource consumption.

The affected systems are Bitcoin Core implementations through version 31.1. Nodes running these versions are susceptible regardless of operating system or deployment environment, as the flaw resides in the core undo handling logic.

The CVSS score is not publicly disclosed and EPSS data is unavailable, so the exact exploitation probability is unknown. However, the lack of a size cap makes the flaw theoretically easy to trigger and therefore presents a moderate to high risk for denial of service. No security advisories are listed in the KEV catalog. The most likely attack vector is a local or network-based actor who can write or influence large undo files, such as a malicious peer or compromised node.