Bitcoin Core has disclosed three node vulnerabilities found through an automated large-language-model scan after shipping fixes across four maintained software branches. The releases address a remotely triggerable memory-exhaustion crash on Windows, macOS and BSD, a slower message-queue exhaustion path, and an extreme undo-file overflow scenario. Bitcoin Core classifies the first two issues as medium severity and the third as low severity. The project said the findings were validated by human contributors before reaching its security team, making the disclosure a practical test of its new policy for bugs that automated tools can rediscover easily.

Non-Linux nodes faced a remote crash path

The most direct issue affected Bitcoin Core's select-based socket backend on platforms other than Linux. A malicious connected peer could send TCP urgent data after normal reads had been paused, bypassing the node's backpressure limit and continuing to queue data in memory. Bitcoin Core's advisory says the condition could trivially exhaust memory and crash Windows, macOS or BSD nodes. Linux uses a different poll-based path and is not affected by this specific flaw. Fixes arrived in versions 31.2 and 32.1 on October 27, followed by 29.5 and 30.4 on October 28.

Related reporting: Bitcoin Core Fast-Tracks Fixes for AI-Discoverable Bugs

A second peer could consume memory more slowly

Another medium-severity flaw involved peers that claimed not to support BIP31's nonced ping messages. Bitcoin Core continued adding transaction announcements to a paused peer's outbound queue, while the usual 20-minute timeout did not apply to those older-style connections. The advisory estimates growth of as much as 2 megabytes per hour for each inbound peer and 5 megabytes per hour for each outbound peer. Nodes running in blocks-only mode were less exposed because transaction announcements account for most of the queued data.

Undo-file overflow remains an edge-case concern

The low-severity issue concerned files that record information needed to reverse blocks during a chain reorganization. Under an impractical sequence involving thousands of specially constructed blocks, an undo file could exceed the range of its stored position value and corrupt data. The fix moved those positions to 64-bit integers without changing the on-disk format. Bitcoin Core says exploitation on ordinary 64-bit systems would require roughly a month of total network block production plus a precisely timed reorganization. However, 32-bit systems and nodes whose block directory uses FAT32 remain affected by file-position or file-size limits.

AI discovery changed the disclosure timetable

All three findings came from Project Loupe, an automated LLM-based code scan developed by Elias Rohrer at Spiral, and were then checked by Gregory Sanders before referral to Bitcoin Core. Two issues were also found independently by other developers. Under the policy adopted on October 22, vulnerabilities judged easily discoverable can be patched in every maintained branch and disclosed immediately rather than waiting for the normal severity-based embargo. The aim is to reduce the period in which users lack a fix when attackers could reproduce the finding with minimal automated effort.

What node operators should do

Operators on maintained branches should move to 29.5, 30.4, 31.2 or 32.1 as appropriate and verify that production nodes actually restarted on the updated binary. Users of Windows, macOS and BSD have the clearest urgency because the TCP issue does not affect Linux. Operators should also review whether any block data sits on FAT32 or a 32-bit environment, since the undo-file limitation is not fully removed there. Version 29 and older are now end of life following the 32.1 release, so organizations relying on those branches should plan beyond this emergency patch. Bitcoin Core also said three additional medium- and high-severity flaws fixed in version 30.0 are scheduled for disclosure in two weeks.

Sources

AI-generated editorial image; not a photograph of the reported event. Prepared with AI assistance and source verification.