TL;DR
Bitcoin Core fixed a Medium-severity memory exhaustion flaw that let malicious peers crash Windows, macOS and BSD nodes, while Linux remained unaffected.
Patched versions 29.5, 30.4, 31.2 and 32.1 were released across maintained branches after the vulnerability was identified through Project Loupe’s automated LLM scan.
The bug affected node availability rather than Bitcoin consensus or fund ownership, and operators on platforms should move to patched releases to remove exposure.
Bitcoin Core released fixes for a memory exhaustion vulnerability that could let a malicious peer remotely crash nodes running on Windows, macOS or BSD. In an official security advisory , the project said affected systems use a select() -based socket backend that could queue data without limit. The flaw was rated Medium severity and did not affect Linux nodes, which use a different poll() -based path. The disclosure adds another security test for the Bitcoin network .
Malicious Peers Could Bypass Bitcoin Core’s Memory Limits
The vulnerability bypassed Bitcoin Core’s normal backpressure mechanism. When a peer’s processing queue grows beyond a configured limit, the software pauses reads to prevent further memory consumption. However, the select() backend continued monitoring exceptional socket conditions while reads were paused. A connected attacker could send TCP urgent data to trigger additional reads and cause unbounded memory growth until the node exhausted available memory. This made Windows, macOS and BSD nodes remotely crashable by a malicious peer.
Bitcoin Core patched the issue in versions 29.5, 30.4, 31.2 and 32.1. Versions 31.2 and 32.1 arrived on October 27, followed by 29.5 and 30.4 on October 28. The fix was backported across multiple release branches rather than reserved for one major version. That approach reflects Bitcoin Core’s revised security policy for AI-discoverable flaws , which accelerates fixes and disclosure for vulnerabilities considered easily discoverable.
The bug was discovered on October 23 through Project Loupe, an automated LLM scan developed by Elias Rohrer at Spiral. Gregory Sanders validated the finding and reported it to the security team that day. Antoine Poinsot opened the fix on October 26 before it was merged and backported. The finding shows how AI-assisted scanning can identify exploitable software paths while still requiring human validation before remediation. It follows earlier Bitcoin Core memory-security fixes .
Bitcoin Core disclosed two other issues alongside the urgent-data flaw. One could cause slow, unbounded memory growth through paused pre-BIP31 peers, while another involved undo-file overflow under extreme conditions. The TCP urgent-data vulnerability represented a node-availability problem rather than a compromise of Bitcoin’s consensus rules or ownership of funds. The episode adds context to Bitcoin Core’s broader security process, which has also included an independent audit of sensitive node components . Operators on affected systems should use patched releases to eliminate exposure to this specific remote crash vector.
