<p>For a list of historical Bitcoin related CVEs (common vulnerabilities and exposures) see the <a href="https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures" rel="nofollow noreferrer">Bitcoin wiki</a>.</p>
<p>However, for a focus on Bitcoin Core vulnerabilities found by fuzzing there is a <a href="https://github.com/bitcoin-core/bitcoin-devwiki/wiki/Fuzz-Trophies" rel="nofollow noreferrer">resource</a> on the Bitcoin Core dev wiki on &quot;fuzz trophies&quot;.</p>
<p>Marco Falke stated <a href="https://github.com/bitcoin/bitcoin/pull/21856#issuecomment-832438136" rel="nofollow noreferrer">here</a> in May 2021:</p>
<blockquote>
<p>I did a survey of all bugs found first by fuzzing, excluding known
bugs that can merely be reproduced by fuzzing (regression fuzz
testing). I found that most bugs fall into one of the categories:</p>
<ul>
<li>Silent merge conflict (forgetting to update the fuzz target after code changes)</li>
<li>A bug in the fuzz target itself</li>
<li>A recently introduced critical (exploitable) bug, but only present in    the master main development branch</li>
<li>A minor (non-exploitable) bug, potentially present in previous    releases</li>
</ul>
</blockquote>

CC BY-SA 4.0
2021-02-20T13:36:00.523Z
2021-05-07T12:08:17.090Z
2021-05-07T12:08:17.090Z
Michael Folkson
<p>Is there a list of vulnerabilities that have been found in Bitcoin Core using fuzz testing?</p>

<bitcoin-core-development><testing><fuzz-test>
What vulnerabilities have been found in Bitcoin Core using fuzzing?
Michael Folkson
# What vulnerabilities have been found in Bitcoin Core using fuzzing?

(Asked by: username_0 on 2021-02-20)

Is there a list of vulnerabilities that have been found in Bitcoin Core using fuzz testing?

**Tags:** bitcoin-core-development, testing, fuzz-test


---

## 1 answers

### Answer by username_0 on 2021-02-20. Score: 1 | Accepted answer

For a list of historical Bitcoin related CVEs (common vulnerabilities and exposures) see the [Bitcoin wiki](https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures).

However, for a focus on Bitcoin Core vulnerabilities found by fuzzing there is a [resource](https://github.com/bitcoin-core/bitcoin-devwiki/wiki/Fuzz-Trophies) on the Bitcoin Core dev wiki on "fuzz trophies".

Marco Falke stated [here](https://github.com/bitcoin/bitcoin/pull/21856#issuecomment-832438136) in May 2021:

> I did a survey of all bugs found first by fuzzing, excluding known
> bugs that can merely be reproduced by fuzzing (regression fuzz
> testing). I found that most bugs fall into one of the categories:
>
> * Silent merge conflict (forgetting to update the fuzz target after code changes)
> * A bug in the fuzz target itself
> * A recently introduced critical (exploitable) bug, but only present in the master main development branch
> * A minor (non-exploitable) bug, potentially present in previous releases


---

