Bitcoin Core 32 Enters Final Testing With Faster Fee Estimates, Security Fixes

Bitcoin Core, the software most Bitcoin nodes run, tagged the first release candidate for version 32.0 on September 14, starting the final testing period before a scheduled stable release on October 10. The update changes how nodes estimate transaction fees and process blocks, and fixes two security flaws discovered before the software shipped.

No Change to Bitcoin’s Consensus Rules

Bitcoin Core lets a computer independently verify transactions and blocks against Bitcoin’s rules without relying on another service. Version 32 does not alter those consensus rules, according to the project’s draft release notes.

The update instead focuses on performance and wallet-handling improvements built on top of the existing protocol.

Faster Fee Estimates and Block Processing

Bitcoin Core currently estimates appropriate transaction fees largely by looking at what fees were attached to transactions in recently confirmed blocks. Version 32 adds a second estimator that also looks at transactions currently waiting in the mempool for confirmation.

The software compares both estimates and can recommend the lower fee when current network conditions support it. That is intended to let fee estimates drop more quickly once congestion clears, rather than continuing to reflect the higher fees paid in earlier, more congested blocks.

Nodes will also be able to pull transaction data from their databases using multiple processing threads simultaneously while validating blocks. Bitcoin Core will use eight threads by default, a change intended to reduce the time nodes spend waiting on disk reads while catching up with the blockchain.

A Long-Standing Wallet Flaw Gets Fixed

Developers fixed a vulnerability that had existed in Bitcoin Core since version 24.0 on non-Windows systems. An authenticated user with permission to create wallets could assign a wallet a specially crafted name and, under certain conditions, trigger commands to run on the computer hosting the node.

Exploiting the flaw required the node operator to have enabled walletnotify, a feature that automatically executes a chosen command whenever a wallet transaction occurs. Version 32 fixes the issue by treating wallet names strictly as literal text rather than allowing portions of a name to be interpreted as executable commands.

PSBT Version 2 Becomes the Default

Four Bitcoin Core commands used to build partially signed Bitcoin transactions will switch to the newer PSBT version 2 format by default. Those partially signed transactions are commonly exchanged between wallet software and hardware signing devices before a transaction is broadcast.

Applications can still request the older PSBT format, but services built directly around the affected Bitcoin Core commands will need to confirm they support version 2 before the update ships.

New Web Server Had a Memory-Exhaustion Flaw

Version 32 also replaces Bitcoin Core’s existing web server, the component that handles requests from other applications communicating with a node. An audit of the new server, conducted using Moonshot AI’s Kimi K3 model, found it could keep accepting incoming data from a client while still processing an earlier request from that same client.

That data accumulated in memory faster than the server could clear it, creating a path for memory use to climb until a node ran out of available memory. The developer who submitted the fix described the issue as a memory-exhaustion scenario. 

Because the new server had not yet appeared in a stable Bitcoin Core release, the flaw was caught before it reached production use.

Testing also found the issue affected Bitcoin Core’s REST interface, which does not require login credentials to use. In one test, 16 unauthenticated REST connections pushed a test node’s memory use from 46 MB to about 3 GB in roughly one minute. A separate 90-second test consumed 3.2 GB of memory before the fix and about 3 MB after it was applied.