Bitcoin · Bitcoin Core · CVE-2023-50428
**Name of the Vulnerable Software and Affected Versions**
Bitcoin Core versions prior to 26.1
Bitcoin Knots versions prior to 25.1.knots20231115
**Description**
Datacarrier size limits can be bypassed by obfuscating data as code, such as using `OP FALSE OP IF`. This issue was exploited in the wild by Inscriptions during 2022 and 2023. The `datacarriersize` setting was intended to limit the size of data in carrier transactions, but it only restricted `OP RETURN` script sizes and did not limit witness data or other methods of encoding data. While the Bitcoin Knots project classifies this as a vulnerability, other parties consider it a design choice rather than a bug.
**Recommendations**
Update Bitcoin Core to version 26.1 or later.
Update Bitcoin Knots to version 25.1.knots20231115 or later.