Image Credit: Shutterstock
- An automated AI scan discovered a Bitcoin Core flaw capable of crashing nodes.
- Connected attackers can bypass memory limits on Windows, macOS, and BSD systems.
- Fixes are available in versions 29.5, 30.4, 31.2, and 32.1.
An automated AI scan uncovered a Bitcoin Core flaw that could let a connected attacker crash nodes on Windows, macOS, and BSD. Gregory Sanders verified the finding and reported it to the project’s security team.
Fixes are available in Bitcoin Core 29.5, 30.4, 31.2, and 32.1. Linux nodes are unaffected by this particular vulnerability.
Human Verification Turned an AI Finding Into a Patch
The discovery came through Elias Rohrer’s Project Loupe at Spiral, which uses automated language-model scans. Loupe identified the flaw on Oct. 23, and Sanders validated and reported it that day.
Developer Antoine Poinsot submitted a fix on Oct. 26. It was merged and applied to four release branches, with versions 31.2 and 32.1 released on Oct. 27, followed by 29.5 and 30.4 on Oct. 28. Public disclosure followed on Oct. 28.
Operators updating affected nodes should shut Bitcoin Core down completely before installing a fixed release. Downloads are available through the project’s official website, bitcoincore.org.
Although 29.5 contains these fixes, the 29.x branch has reached end of life and will receive no further updates.
Connected Peers Can Bypass Memory Limits on Non-Linux Nodes
Bitcoin Core normally limits how much incoming data it queues from each peer. When that queue becomes too large, it pauses further reads to prevent excessive memory use.
On affected systems, specially marked urgent network data could trigger additional reads despite that pause. A malicious peer already connected to the node could keep expanding the queue until the process ran out of memory and crashed.
The bug impacts how Windows, macOS, and BSD nodes monitor network connections. Linux handles those connections differently and avoids this flaw. Bitcoin Core classifies the vulnerability as Medium severity.
Separate Bugs Affect Memory Queues and Undo Files
Another Oct. 28 disclosure describes slow memory growth caused by peers pretending to use an older protocol. Those connections could evade the normal disconnection mechanism and leave outgoing announcements accumulating indefinitely. The same four patched versions address that issue.
A separate undo-file overflow can shut nodes down under extreme conditions and is considered impractical to exploit. The releases fix it on 64-bit systems, but 32-bit systems and nodes storing blocks on FAT32 remain affected by the described limitation.
Easily Discoverable Bugs Receive Prompt Patches and Advisories
Bitcoin Core’s disclosure policy calls for patched releases across maintained versions as soon as possible when a vulnerability is considered easily discoverable. Public advisories accompany those fixes without the usual severity-based embargo.
The policy explicitly includes bugs discoverable with minimal effort, such as through a simple language-model prompt. The newly disclosed crash flaw falls into that category.
