Bitcoin Core disclosed three vulnerabilities on 28 October after releasing fixes across maintained versions 29 through 32. The most serious of the group allows a malicious peer to exhaust memory and crash nodes running Windows, macOS or BSD. Linux nodes do not use the affected socket path.
The primary advisory says TCP urgent data could bypass Bitcoin Core’s backpressure controls and create an unbounded processing queue. Project Loupe, an automated large-language-model scan operated at Spiral, identified the flaw on 23 October. A human contributor validated it the same day. bitcoincore.org
A second medium-severity flaw allowed a peer pretending to use an old protocol version to remain connected while queued announcements accumulated. Memory could grow by as much as 2 MB per hour for each inbound peer and 5 MB per hour for each outbound peer. The scan found it on 15 September, and another developer independently rediscovered it six days later.
The third advisory concerns undo-file offsets. Exploitation on ordinary 64-bit systems would require an impractical amount of mining, so Bitcoin Core rated it low severity. Nodes on 32-bit systems or using FAT32 storage remain exposed to the file-size limitation even after the broader fix.
Operators on supported systems should move to Bitcoin Core 29.5, 30.4, 31.2 or 32.1. The releases implement fixes before or alongside public disclosure under the project’s new policy for vulnerabilities considered easy to rediscover with language models.
TOKEN RECON ASSESSMENT
The key event is not that AI wrote a security report. It is that a remotely triggerable node crash moved from discovery to validated patches and public disclosure in five days. Bitcoin Core’s accelerated policy reduces the value of a long embargo when cheap automated scans can reproduce a flaw. The remaining risk is upgrade adoption, especially among non-Linux operators. Three additional medium and high-severity issues fixed in version 30.0 are scheduled for disclosure in two weeks, creating another concrete patch deadline.
Sources
Bitcoin Core, TCP urgent-data memory exhaustion advisory
Bitcoin Core, paused peer memory-growth advisory
