Bitcoin Core published three security advisories on October 28 for bugs found by an automated language-model scan, all fixed in versions 29.5, 30.4, 31.2 and 32.1. Two let a malicious peer fill a node's memory until it shuts down, and one can be used to trivially crash any node that does not run on Linux.
Bug 1: TCP urgent data on Windows, macOS and BSD
On platforms other than Linux, Bitcoin Core monitors sockets with a select()-based backend. That backend watched for exceptional conditions even when reads from a peer were paused, according to the Bitcoin Core advisory.
A peer could send TCP urgent (out-of-band) data to bypass the backpressure mechanism and queue an unbounded amount of data. In practice, a malicious peer can trivially crash any Windows, macOS or BSD node it is connected to.
- Severity: Medium, classified as easily discoverable
- Linux nodes are not affected, since they use poll()
- Identified on October 23, PR #36665 opened by Antoine Poinsot on October 26
Bug 2: slow memory growth via pre-BIP31 peers
Bitcoin Core queues announcements, mainly transaction INVs, for all peers, including paused ones. Peers that fail to answer a nonced ping within 20 minutes get disconnected, but that rule does not apply to peers that do not support BIP 31, the second advisory says.
An attacker can pretend not to support BIP 31 and strategically delay reading messages, letting the queue grow without limit.
- Memory growth: up to 2 MB per hour per inbound peer and 5 MB per hour per outbound peer
- Nodes running with -blocksonly are much less affected
- Medium severity; found by Loupe on September 15 and independently rediscovered by L0rinc on September 21
Bug 3: undo file overflow
A miner can produce valid blocks whose undo data is far larger than the blocks themselves, enough to push a single rev*.dat file past 4 GiB. Positions were stored as 32-bit integers, so newer undo data overwrites older data, and if a reorg later hits an affected block the node cannot read it and shuts down, the third advisory explains. Restarting does not help, and recovery requires a -reindex with a fixed version.
On Windows and 32-bit systems the limit is 2 GiB and no reorg is needed: the node fails to write undo data and shuts down on every restart.
- Severity: Low; exploiting it on 64-bit systems is impractical
- An attacker would need to mine several thousand blocks, roughly a month of the entire network's output
- 32-bit systems and nodes storing blocks on FAT32 remain affected after the fix
- Reported by Loupe on July 8, then independently by L0rinc (August 21) and Andrew Dorman (October 23)
Who found them and why they are already public
All three were discovered through an automated LLM scan as part of Project Loupe, run by Elias Rohrer at Spiral. The findings were validated and passed to the Bitcoin Core security team by Gregory Sanders.
Bitcoin Core's policy defines easily discoverable vulnerabilities as those found with minimal effort, such as through a simple LLM prompt. For these, the team ships a point release with the fix for every maintained major version, plus an advisory, without the standard embargo period.
Under the normal timeline, Medium and High severity bugs are disclosed two weeks after the last affected release reaches end of life, roughly a year after the first major version containing the fix.
Fixed versions | Release date |
|---|---|
31.2 and 32.1 | October 27, 2026 |
29.5 and 30.4 | October 28, 2026 |