CVE-2025-65548
📋 TL;DR
CVE-2025-65548 is a denial-of-service vulnerability in Cashu implementations that allows attackers to fill a mint's database and disk with arbitrary data by creating tokens with oversized preimages. This affects any system running vulnerable versions of cashubtc/nuts (nutshell) that accept Cashu tokens. The vulnerability enables resource exhaustion attacks against mints.
💻 Affected Systems
- cashubtc/nuts (nutshell)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service as the mint's database and disk become filled with attacker-controlled data, rendering the service unavailable and potentially causing data corruption.
Likely Case
Degraded performance and eventual service unavailability as disk space is consumed by malicious preimage data.
If Mitigated
Minimal impact if proper input validation is implemented to restrict preimage size.
🎯 Exploit Status
Exploitation requires creating Cashu tokens with oversized preimages, which is straightforward given the public disclosure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.18.0 and later
Vendor Advisory: https://github.com/cashubtc/nuts/blob/main/07.md
Restart Required: Yes
Instructions:
1. Update to nutshell version 0.18.0 or later. 2. Restart the mint service. 3. Verify the update was successful.
🔧 Temporary Workarounds
Rate limiting
allImplement rate limiting on token creation endpoints to restrict the volume of malicious requests.
Input validation
allManually add preimage size validation before storing in database.
🧯 If You Can't Patch
- Monitor disk usage and database growth for abnormal patterns
- Implement network-level restrictions to limit token creation from untrusted sources
🔍 How to Verify
Check if Vulnerable:
Check if running nutshell version earlier than 0.18.0 and if NUT-14 functionality is enabled.Check Version:
nutshell --version or check package managerVerify Fix Applied:
Confirm version is 0.18.0 or later and test that oversized preimages are rejected.📡 Detection & Monitoring
Log Indicators:
- Unusually large preimage storage entries
- Rapid database growth
- Disk space alerts
Network Indicators:
- High volume of token creation requests
- Large payloads in token-related API calls
SIEM Query:
source="mint_logs" AND (message="preimage" AND size>threshold) OR disk_usage>90%🔗 References
- https://bitcointalk.org/index.php?topic=5564329
- https://delvingbitcoin.org/t/public-disclosure-denial-of-service-using-htlc-in-cashu/2090
- https://github.com/cashubtc/nuts/blob/main/07.md
- https://github.com/cashubtc/nuts/blob/main/14.md
- https://github.com/jamesob/delving-bitcoin-archive/blob/master/archive/rendered-topics/2025-11-November/2025-11-02-public-disclosure-denial-of-service-using-htlc-in-cashu-id2090.md
- https://preimage007.github.io/
- https://bitcointalk.org/index.php?topic=5564329
- https://github.com/jamesob/delving-bitcoin-archive/blob/master/archive/rendered-topics/2025-11-November/2025-11-02-public-disclosure-denial-of-service-using-htlc-in-cashu-id2090.md
