EDITOR WIRE | 2026-10-28 | BLOCK 973583
BITCOIN $81,128 | GOLD $4,060 | OIL $111.48 | S&P 500 $7,746 | US 10Y 5.03%
Bitcoin Core publishes three security advisories alongside patched releases
Bitcoin Core has published advisories detailing three vulnerabilities addressed in versions 29.5, 30.4, 31.2 and 32.1. The website update merged on October 28, and all three disclosures are now available on bitcoincore.org. Two flaws are rated medium severity and one low; “easily discoverable” describes how readily researchers can find them, not their severity.
The most immediate crash risk affects Windows, macOS and BSD nodes. A malicious connected peer could exploit TCP urgent-data handling to bypass a limit on queued incoming data, exhausting memory and crashing the node. Linux uses a different socket-monitoring backend and is not affected by this particular flaw. That exemption does not extend to the other vulnerabilities.
A second flaw allows a malicious peer claiming an old protocol version to remain connected while reading messages too slowly. Bitcoin Core continues queuing announcements even after sending is paused, allowing memory consumption to grow without bound. Nodes running in blocks-only mode are much less affected because transaction announcements account for most of the accumulating data.
The third issue concerns “undo” files, which nodes use to reverse blocks during a chain reorganization. Under extreme conditions, file-position limits can cause data corruption or repeated shutdowns. The advisory describes exploitation on ordinary 64-bit systems as impractical, requiring thousands of specially constructed mined blocks and precise placement and reorganization conditions. The fixes address 64-bit systems, including Windows, but 32-bit systems and nodes storing blocks on FAT32 remain affected. Recovering a node with corrupted undo data can require reindexing with a fixed version.
All three findings emerged from automated LLM scanning through Elias Rohrer’s Project Loupe at Spiral and were validated and reported to the Bitcoin Core team by Gregory Sanders; the disclosures also credit independent discoveries. The practical concern is node availability and the services built on it—not a demonstrated theft of bitcoin or network-wide consensus failure. The disclosures do not establish exploitation in the wild.
Operators should install an appropriate fixed release, check their operating-system architecture and blocks-directory filesystem, and follow the project’s signed-download verification instructions. The 32.1 release notes also clarify that 32.0 was tagged but never fully released because of last-minute issues. Although 29.5 includes these fixes, the notes mark 29.x and older as end-of-life; that patch should not be mistaken for a promise of continued maintenance.
Sources:
https://bitcoincore.org/en/2026/10/28/disclose-tcp-oom/
https://bitcoincore.org/en/2026/10/28/disclose-fpausesend-oom/
https://bitcoincore.org/en/2026/10/28/disclose-undo-overflow/
https://github.com/bitcoin-core/bitcoincore.org/pull/1296
https://github.com/bitcoin/bitcoin/releases/tag/v32.1
https://github.com/bitcoin/bitcoin/blob/master/doc/release-notes/release-notes-32.1.md
WIRE / CITADEL WIRE
npub1q8…382kp
2026-10-28 18:51:27 UTC
Author Public Key
npub1q8g803ajr0lw3xngs0k6hn2q3mejf6dtgv05d06h6krqgv9uh97q5382kpSeen on
wss://wot.utxo.onePublished at
2026-10-28 18:51:27 UTCEvent JSON
{
"id": "8f14ba7e9d952aaaf97021b69329b6c1e9da5acde026614ee0a6906e945cf682",
"pubkey": "01d077c7b21bfee89a6883edabcd408ef324e9ab431f46bf57d5860430bcb97c",
"created_at": 1793213487,
"kind": 1,
"tags": [],
"content": "EDITOR WIRE | 2026-10-28 | BLOCK 973583\nBITCOIN $81,128 | GOLD $4,060 | OIL $111.48 | S\u0026P 500 $7,746 | US 10Y 5.03%\n\nBitcoin Core publishes three security advisories alongside patched releases\n\nBitcoin Core has published advisories detailing three vulnerabilities addressed in versions 29.5, 30.4, 31.2 and 32.1. The website update merged on October 28, and all three disclosures are now available on bitcoincore.org. Two flaws are rated medium severity and one low; “easily discoverable” describes how readily researchers can find them, not their severity.\n\nThe most immediate crash risk affects Windows, macOS and BSD nodes. A malicious connected peer could exploit TCP urgent-data handling to bypass a limit on queued incoming data, exhausting memory and crashing the node. Linux uses a different socket-monitoring backend and is not affected by this particular flaw. That exemption does not extend to the other vulnerabilities.\n\nA second flaw allows a malicious peer claiming an old protocol version to remain connected while reading messages too slowly. Bitcoin Core continues queuing announcements even after sending is paused, allowing memory consumption to grow without bound. Nodes running in blocks-only mode are much less affected because transaction announcements account for most of the accumulating data.\n\nThe third issue concerns “undo” files, which nodes use to reverse blocks during a chain reorganization. Under extreme conditions, file-position limits can cause data corruption or repeated shutdowns. The advisory describes exploitation on ordinary 64-bit systems as impractical, requiring thousands of specially constructed mined blocks and precise placement and reorganization conditions. The fixes address 64-bit systems, including Windows, but 32-bit systems and nodes storing blocks on FAT32 remain affected. Recovering a node with corrupted undo data can require reindexing with a fixed version.\n\nAll three findings emerged from automated LLM scanning through Elias Rohrer’s Project Loupe at Spiral and were validated and reported to the Bitcoin Core team by Gregory Sanders; the disclosures also credit independent discoveries. The practical concern is node availability and the services built on it—not a demonstrated theft of bitcoin or network-wide consensus failure. The disclosures do not establish exploitation in the wild.\n\nOperators should install an appropriate fixed release, check their operating-system architecture and blocks-directory filesystem, and follow the project’s signed-download verification instructions. The 32.1 release notes also clarify that 32.0 was tagged but never fully released because of last-minute issues. Although 29.5 includes these fixes, the notes mark 29.x and older as end-of-life; that patch should not be mistaken for a promise of continued maintenance.\n\nSources:\nhttps://bitcoincore.org/en/2026/10/28/disclose-tcp-oom/\nhttps://bitcoincore.org/en/2026/10/28/disclose-fpausesend-oom/\nhttps://bitcoincore.org/en/2026/10/28/disclose-undo-overflow/\nhttps://github.com/bitcoin-core/bitcoincore.org/pull/1296\nhttps://github.com/bitcoin/bitcoin/releases/tag/v32.1\nhttps://github.com/bitcoin/bitcoin/blob/master/doc/release-notes/release-notes-32.1.md\n",
"sig": "cfabd21da3787b7c54279f8f08d67bd2eb80637113a6c7602de37e4fe97a76e1daeefbfe099daa9b1ef445d5419b34ea8b8ad4244b083c6870821b9e5829ebbd"
}