Reporting: sourced factual coverage reviewed by the editorial desk.
Bitcoin Core has disclosed a vulnerability that could let a malicious network peer crash a Bitcoin node running on Windows, macOS or BSD by exhausting its memory. The project says fixes are available in versions 29.5, 30.4, 31.2 and 32.1.
The October 28 advisory describes a problem in how non-Linux systems handle an exceptional socket event. A peer could use TCP urgent data to bypass a limit intended to stop too much incoming data from accumulating. Bitcoin Core classifies the issue as medium severity and says the Linux code path is not affected by this particular bug.
A node validates and relays Bitcoin transactions and blocks. A crash can interrupt an operator’s node service; the advisory does not say the flaw lets an attacker steal coins or change Bitcoin’s supply. People using a hosted exchange or wallet should not assume they run Bitcoin Core themselves. Node operators should check their software version and consult the project’s original release information before upgrading.
The same day, Bitcoin Core described a separate medium-severity memory-growth issue involving peers that do not support a newer ping mechanism. In that case, the project says an attacker could keep a connection paused while announcements accumulate slowly. It lists the same four fixed versions. The project says fixes were merged October 26 and released across maintained branches on October 27 and 28.
Both issues were identified through Project Loupe and validated by Gregory Sanders, according to Bitcoin Core. The first advisory concerns the non-Linux socket path; the second concerns a distinct peer-message queue. Neither advisory establishes that these flaws have been exploited in the wild.
Sources & evidence
Bitcoin Core — TCP urgent data advisory ↗
Bitcoin Core — paused-peer advisory ↗
Author disclosure
AI assisted research and drafting based on Bitcoin Core’s original advisories. No interviews or independent tests were conducted. RailsRecord is a Joaico publication; material publisher holdings have not been established.
Corrections
Identify this article and the disputed claim in a correction request to corrections@railsrecord.com ↗. The publisher reviews supporting primary evidence.
Reader discussion
Comment on this article or reply to another reader. Comments and replies are held for review before appearing publicly.
Loading discussion…