Bitcoin Core Fixes Three Vulnerabilities Affecting Node Security and Stability
Bitcoin Core disclosed three software vulnerabilities on Oct. 28 and released patches across versions 29.5, 30.4, 31.2 and 32.1. The fixes address two flaws that can cause excessive memory consumption and a separate storage vulnerability that could corrupt blockchain data or shut down affected nodes.
One of the vulnerabilities allows a malicious peer to crash Bitcoin Core nodes running Windows, macOS and BSD by exploiting how they handle certain network traffic. Linux systems are not affected by this particular flaw because they use a different mechanism to monitor network connections.
The three security advisories classify two memory-growth issues as medium severity and the blockchain storage flaw as low severity. They do not indicate whether any of the vulnerabilities have been exploited in the wild.
Bitcoin Core Updates Address Two Memory-Exhaustion Risks
The first memory-related vulnerability involves TCP urgent data, a networking feature that can be abused by a connected attacker to bypass limits on incoming data awaiting processing. This can cause a node's queue to expand without restriction until the system runs out of memory, potentially crashing the software.
A second vulnerability involves malicious peers claiming to use an outdated communication protocol that does not support modern ping messages. By avoiding the timeout mechanism that would normally disconnect an unresponsive peer and delaying data reads, an attacker can force a node to accumulate network announcements in its queue.
According to the advisory, memory consumption under this attack can increase by as much as 2 MB per hour for each inbound peer and 5 MB per hour for each outbound peer. Nodes configured to relay blocks only are significantly less exposed to this particular issue.
Blockchain Storage Vulnerability Has Additional Limitations
The third vulnerability affects undo files, which contain information Bitcoin Core needs to reverse block changes during a blockchain reorganization. A miner could potentially force these files beyond their permitted size limits, resulting in data corruption or node shutdowns.
Bitcoin Core describes exploitation as impractical. On 64-bit systems, an attacker would need to mine several thousand specially constructed blocks before meeting additional requirements for a reorganization-based attack.
The patches address this vulnerability on 64-bit systems, including Windows. However, 32-bit systems and nodes that store blockchain data on FAT32 filesystems remain affected.
Nodes with undo data that has already been corrupted cannot be recovered simply by restarting the software. According to the advisory, operators must rebuild the blockchain index using a fixed version of Bitcoin Core.
AI-Assisted Security Scan Identified the Three Bugs
The advisories credit an automated AI scan conducted by Spiral's Project Loupe with discovering all three vulnerabilities. Gregory Sanders subsequently validated the findings and reported them to Bitcoin Core.
The project classified the vulnerabilities as “easily discoverable.” Under its disclosure policy, this category calls for fixes to be published across maintained software branches alongside a security advisory, without the usual embargo.
Which Bitcoin Core Versions Should Operators Update?
The patched releases are Bitcoin Core 29.5 for the 29.x branch, 30.4 for the 30.x branch, and 31.2 for the 31.x branch. Version 32.1 is the latest release identified in the advisories. Operators using earlier point releases within these branches should upgrade to the corresponding patched version.
The release instructions recommend shutting down Bitcoin Core completely before installing or replacing the software. They also state that versions 29.x and older have reached end of life and will no longer receive updates.
source: thedefiant
Writer: Ethan Collins
Crypto Journalist
Ethan Collins reports on developments across the cryptocurrency and blockchain sector. His work covers market movements, protocol updates, regulatory changes, and emerging trends in digital assets.
He focuses on presenting complex topics in a clear and accessible manner for a broad readership.
Check out other news and articles on Google News
Disclaimer:
The articles on Hokanews are here to keep you updated on the latest buzz in crypto, tech, and beyond—but they’re not financial advice. We’re sharing info, trends, and insights, not telling you to buy, sell, or invest. Always do your own homework before making any money moves.
Hokanews isn’t responsible for any losses, gains, or chaos that might happen if you act on what you read here. Investment decisions should come from your own research—and, ideally, guidance from a qualified financial advisor. Remember: crypto and tech move fast, info changes in a blink, and while we aim for accuracy, we can’t promise it’s 100% complete or up-to-date.