Bitcoin Core has disclosed a medium-severity vulnerability that allows malicious peers to crash nodes running on Windows and macOS. By sending specific TCP urgent data, attackers can trigger memory exhaustion, causing the software to stop validating and relaying transactions until a manual restart.
The flaw stems from differences in how socket monitoring mechanisms, specifically select() and poll(), handle network connections on non-Linux systems. This leads to unbounded memory growth. The issue was identified alongside two other vulnerabilities: a slow memory growth bug related to older BIP31 protocol peers and an undo-file overflow.
Patches for these issues are available in Bitcoin Core versions 29.5, 30.4, 31.2, and 32.1. Versions 31.2 and 32.1 were released on October 27, while the others followed on October 28, 2026. Notably, no CVE identifiers were assigned to these vulnerabilities, marking a change in the project's disclosure practices.
The vulnerabilities were discovered using Project Loupe, a code scanning tool developed by Elias Rohrer at Spiral, and validated by Gregory Sanders. The findings highlight the increasing ease of identifying software bugs through machine learning, prompting Bitcoin Core to accelerate its patch rollout process for easily discoverable flaws.
