Bitcoin Core Fixes Memory Flaw That Lets Peers Crash Non-Linux Nodes

Bitcoin Core publicly disclosed three vulnerabilities fixed in releases 29.5, 30.4, 31.2 and 32.1, the most serious of which lets a malicious peer crash Windows, macOS or Berkeley Software Distribution (BSD) nodes by exhausting their memory. Bitcoin Core credits all three issues to an automated large language model (LLM) scan, part of Elias Rohrer's Project Loupe at Spiral, which Gregory Sanders validated and surfaced to the Bitcoin Core team.

Rod Palmer, a bitcoin podcaster and journalist at The Bitcoin Bugle, posted the disclosures on X and said Loupe identified the flaws alongside other researchers, including developer L0rinc of the Bitcoin Red Team. Bitcoin Core users on Linux are not affected by the crash bug, but node operators running affected versions on any system should check their version numbers and install the patches.

A Crash Bug Outside Linux

The first flaw involves Transmission Control Protocol (TCP) urgent, or out-of-band, data. On platforms other than Linux, a malicious peer could cause a node to run out of memory by sending that data, and Bitcoin Core rated the issue Medium severity. The advisory describes the impact without softening it:

"a malicious peer can trivially crash any Windows, macOS or BSD node it is connected to."

Bitcoin Core users on Linux are not affected by this issue, according to the same advisory, because the attack depends on how other operating systems handle that urgent data.

A Slow Memory Leak and an Undo-File Overflow

The second flaw lets memory grow slowly on paused peers that predate Bitcoin Improvement Proposal 31 (BIP31). Memory usage could grow at a rate of up to 2MB per hour per inbound peer and 5MB per hour per outbound peer, and Bitcoin Core also rated this one Medium severity. Developer L0rinc independently re-discovered the paused-peer issue, according to the advisory.

The third flaw is an undo-file overflow that can corrupt undo data. Bitcoin Core rated it Low severity and called it impractical to exploit. A fix for 64-bit systems shipped in versions 29.5, 30.4, 31.2 and 32.1, while 32-bit systems and nodes storing blocks on the File Allocation Table (FAT32) file system remain affected. L0rinc and Andrew Dorman each independently reported the undo issue.

Why It Matters

A malicious peer that can crash Windows, macOS or BSD nodes by exhausting memory is striking at the machines Bitcoiners run to verify their own coins without trusting anyone, which makes patching part of self-custody rather than a chore for developers. We think the incentive story favors open-source Bitcoin: an automated LLM scan from Project Loupe at Spiral and independent reports from L0rinc and Andrew Dorman found the flaws, and Bitcoin Core disclosed all three publicly with credit to the finders. Closed fiat systems give users no such view, while every Bitcoin node operator can check the version number and install the patches on their own terms. That is verification and sovereignty working as designed.