The Pulse
Bitcoin Core Discloses Three Bugs Found by an AI Scan
Bitcoin Core disclosed three vulnerabilities found through an automated scan and released fixes across four maintained versions. The advisories describe memory-exhaustion risks and an undo-file overflow that can still affect some systems.
AI.info Team · Written with AI · fact-checked ·
“a malicious peer can trivially crash any Windows, macOS or BSD node it is connected to.”
Bitcoin Core security advisory
Three fixes, four release versions
Bitcoin Core disclosed three vulnerabilities on October 28, each identified by an automated large language model scan through Project Loupe at Spiral. Gregory Sanders validated the findings and brought them to the project’s security team, according to the advisories. All three were classified as “easily discoverable,” a category that triggers disclosure once fixes are available across maintained releases.
The fixes are included in Bitcoin Core versions 29.5, 30.4, 31.2 and 32.1. The 31.2 and 32.1 releases appeared on October 27; versions 29.5 and 30.4 followed on October 28. Bitcoin Core’s 32.1 release notes say version 29.x and older are now end of life, so those versions will no longer receive updates.
TCP urgent data could exhaust memory
The issue described in the lead quote affects nodes on Windows, macOS and BSD, but not Linux. Bitcoin Core uses a socket-monitoring backend based on select() on non-Linux platforms and poll() on Linux. On the affected path, a peer could send TCP urgent data to trigger reads even after Bitcoin Core had paused them to limit queued data.
That bypass let a malicious peer keep adding data to the node’s processing queue without limit, potentially exhausting memory and crashing the node. Project Loupe identified the flaw on October 23, and Bitcoin Core contributor Antoine Poinsot opened a fix on October 26. The project says the fix was merged and backported to versions 29, 30, 31 and 32 before the releases went out.
A second flaw let peer queues grow
A separate medium-severity bug involved peers that do not support BIP 31 nonced ping messages. Bitcoin Core normally disconnects peers that fail to respond to a ping within 20 minutes, but that check does not apply to peers lacking the older protocol feature. A malicious peer could claim not to support it, read messages slowly and leave the node’s outgoing queue growing.
The advisory estimates memory growth of up to 2 megabytes per hour per inbound peer and 5 megabytes per hour per outbound peer. Project Loupe reported the issue on September 15; developer L0rinc independently reported it six days later. Nodes running with the -blocksonly option are much less affected because transaction announcements account for most of the queued messages.
Undo-file bug still affects some systems
The third flaw, rated low severity, involved undo data that Bitcoin Core stores to reverse blocks during a chain reorganization. On 64-bit systems, a miner could in theory push an undo file past 4 GiB, causing positions stored as 32-bit integers to wrap. The advisory calls exploitation impractical: it would require several thousand blocks of nonstandard transactions—roughly a month of the network’s block production—and precise control over a later reorganization.
The fix changes stored file positions to 64-bit integers. But Bitcoin Core says 32-bit systems remain affected because their file-positioning calls are limited to 2 GiB; nodes storing block data on FAT32 also remain exposed because the file system limits files to 4 GiB. Both cases can cause the node to shut down, and restarting does not resolve the problem.
Why Bitcoin Core disclosed the bugs quickly
Bitcoin Core’s security policy says bugs that can be found with minimal effort, including through a simple LLM prompt, receive a point release and advisory as soon as possible, without the usual severity-based waiting periods. The standard schedule otherwise delays disclosure of medium- and high-severity flaws until two weeks after the last affected release reaches end of life. The project’s 32.1 release notes also flag three additional medium- and high-severity vulnerabilities fixed in version 30.0 for disclosure under the regular schedule in two weeks.
The three advisories show the policy’s practical effect: fixes went to four release branches before the details became public on October 28. The undo-file advisory also draws a clear boundary around that protection: updated 64-bit nodes are fixed, but 32-bit systems and FAT32 storage are not.