PyPI/cashu CVE-2025-65548: critical 9.1, EPSS 0.42%
NUT-14 allows cashu tokens to be created with a preimage hash. However, nutshell (cashubtc/nuts) before 0.18.0 do not validate the size of preimage when the token is spent. The preimage is stored by t
Action: Upgrade cashu to 0.18.0 or later.
pip install cashu==0.18.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.18.0 | - |
Fixed versions
| 0.18.0 |
Sources
- osv: PYSEC-2025-89
- https://delvingbitcoin.org/t/public-disclosure-denial-of-service-using-htlc-in-cashu/2090
- https://preimage007.github.io/
- https://bitcointalk.org/index.php?topic=5564329
- https://github.com/cashubtc/nuts/blob/main/07.md
- https://github.com/cashubtc/nuts/blob/main/14.md
- https://github.com/jamesob/delving-bitcoin-archive/blob/master/archive/rendered-topics/2025-11-November/2025-11-02-public-disclosure-denial-of-service-using-htlc-in-cashu-id2090.md
CVE-2025-65548 · published · modified · JSON