The Bitcoin Core development team has disclosed and patched three vulnerabilities in the software that runs the large majority of nodes on the Bitcoin network. None were discovered through an attack or an external report of abuse. They were caught proactively, through automated large-language-model scanning carried out by Project Loupe, a security initiative run by the firm Spiral, with parallel reports submitted by independent researchers L0rinc, a member of the Bitcoin Red Team, and Andrew Dorman.
The Bitcoin protocol itself was not touched by the wave of technical flaws that compromised large parts of internet server infrastructure this month. Charles Guillemet, Chief Technology Officer of Ledger, described the broader environment facing the sector as a terrifying global cybersecurity landscape. Bitcoin's own codebase, however, was not immune to scrutiny, and the three issues found concern how Bitcoin Core manages memory rather than the consensus rules of the network itself.
Three distinct weaknesses
The first flaw allowed unlimited memory growth when a peer simulated non-support for the BIP 31 communication standard. By strategically delaying message reading and evading the mechanism that disconnects inactive nodes after 20 minutes, an attacker could make a node's data queue grow without limit, consuming up to 5 MB per hour on outbound connections.
The second affected every platform except Linux. By sending urgent data through the TCP protocol, an attacker could bypass the processing limit mechanism and queue an excessive amount of information, trivially crashing any node running Windows, macOS or BSD. Linux systems were spared because Bitcoin Core uses different monitoring code on that operating system.
The third involved an overflow in undo data, the information used to reverse transactions during a chain reorganization. These undo files were stored in 32-bit integers with no formal size limit. A miner could generate malicious blocks whose data volume exceeds 4 GiB, causing the log to collapse and new information to overwrite old data. If a reorg then occurred, the affected node would lose the ability to read the information and shut down automatically.
Patches already in circulation
Two of the three bugs were classified as medium severity, both linked to memory exhaustion; the third, the undo data overflow, was rated low severity. Fixes were released on October 27 and 28 through Bitcoin Core versions 29.5, 30.4, 31.2 and 32.1.
The patches do not close every gap. Computers running 32-bit operating systems and nodes that store blocks on FAT32-formatted disks remain exposed to the overflow issue, because of inherent limitations in reading files larger than 4 GiB on those configurations.
The episode illustrates a shift in how vulnerabilities in core Bitcoin software are being found: not through incident response after exploitation, but through systematic, automated scanning combined with independent human review, catching the kind of memory-handling defects that have historically been the entry point for denial-of-service attacks against network infrastructure.
