Bitcoin Core fixes two memory flaws: Linux is exempt from only one

A fast attack on Windows, macOS and BSD

Bitcoin Core publicly disclosed two vulnerabilities on October 28, 2026, allowing a malicious peer to increase a node's memory consumption. Both advisories classify them as medium severity and easily discoverable. They list the same fixed versions: 29.5, 30.4, 31.2 and 32.1. The crucial distinction, however, concerns which machines are exposed and how memory exhaustion can be triggered. Reading only the references to Windows or macOS is not enough to assess the whole problem.

The first flaw involves receiving urgent data over a TCP connection. On platforms other than Linux, the mechanism monitoring connections could trigger a read even after normal data reception from a peer had been paused because its messages were too slow to process. That peer could consequently bypass the queue limit and cause unbounded memory consumption. The advisory identifies Windows, macOS and BSD among the affected systems. Linux uses a different mechanism and is exempt from this specific flaw.

Slow accumulation also affects Linux

The second advisory describes transaction announcements continuing to accumulate for certain peers whose sending is paused. A node normally disconnects a peer that does not answer its presence check. But that protection did not apply to peers claiming not to support the checking messages introduced by BIP 31. An attacker could exploit this situation by strategically delaying the reading of messages and allowing the queue to grow.

Bitcoin Core describes growth of up to 2 megabytes per hour for each affected inbound connection and 5 megabytes per hour for each affected outbound connection. These are limits described in the advisory, rather than measured losses from a public attack. Nodes configured to relay only blocks are much less affected, because transaction announcements make up most of the queue. Unlike the first issue, this advisory does not exclude Linux systems from its scope.

Check the fixed version actually running

Both issues were identified through an automated language-model scan as part of Elias Rohrer's Project Loupe at Spiral. Gregory Sanders validated the findings and passed them to Bitcoin Core's security team. L0rinc also independently rediscovered the slow-accumulation issue. The advisories distinguish detection, human validation, integration of the fixes and public disclosure. Those stages should not be confused with a demonstrated exploit against the network.

Versions 31.2 and 32.1 were released on October 27, followed by versions 29.5 and 30.4 on the 28th of the same month. For operators, the useful check is the software actually running on every node, including secondary installations. The advisories describe threats to service availability; they do not announce stolen private keys or lost bitcoins. A stopped machine can nevertheless interrupt applications that depend on its data. Updating therefore needs to be verified at the individual installation level.