Bitcoin Core bug could crash nodes on Windows and Mac
📋 Summary
Bitcoin Core fixed a bug that allowed a malicious peer to exhaust memory and crash nodes on Windows, macOS, and BSD. Operators should upgrade to versions 29.5, 30.4, 31.2, or 32.1; Linux nodes were not affected by this specific vulnerability.
Bitcoin Core released a fix for a vulnerability that allowed a remote computer to crash network nodes running on Windows, macOS, and BSD systems. Classified as medium severity, the bug could be exploited by a malicious peer to cause memory usage to grow without limit until the software crashed.
The vulnerability was identified on October 23 by an automated scan using a language model and was validated by human developers the same day. Fixes were released in versions 29.5, 30.4, 31.2, and 32.1, published between October 27 and 28. For anyone running a node outside Linux, the practical recommendation is to upgrade immediately to one of these patched versions.
How the bug crashed Bitcoin nodes
According to the official Bitcoin Core advisory, the problem was in the mechanism used to monitor network connections on platforms other than Linux. The software was supposed to temporarily stop reading data when a peer’s queue exceeded a certain limit, preventing excessive memory consumption.
However, TCP data marked as urgent could bypass this protection. An attacker connected to the node could continue sending information and grow the queue without limit. In practice, this made it possible to exhaust available memory and easily crash a vulnerable installation on Windows, macOS, or BSD.
The bug did not give the attacker access to private keys or allow them to create bitcoins. The risk was denial of service: the node would stop working, temporarily interrupting the verification and relaying of blocks and transactions.
📋 Summary
Bitcoin Core fixed a bug that allowed a malicious peer to exhaust memory and crash nodes on Windows, macOS, and BSD. Operators should upgrade to versions 29.5, 30.4, 31.2, or 32.1; Linux nodes were not affected by this specific vulnerability.
Bitcoin Core released a fix for a vulnerability that allowed a remote computer to crash network nodes running on Windows, macOS, and BSD systems. Classified as medium severity, the bug could be exploited by a malicious peer to cause memory usage to grow without limit until the software crashed.
The vulnerability was identified on October 23 by an automated scan using a language model and was validated by human developers the same day. Fixes were released in versions 29.5, 30.4, 31.2, and 32.1, published between October 27 and 28. For anyone running a node outside Linux, the practical recommendation is to upgrade immediately to one of these patched versions.
How the bug crashed Bitcoin nodes
According to the official Bitcoin Core advisory, the problem was in the mechanism used to monitor network connections on platforms other than Linux. The software was supposed to temporarily stop reading data when a peer’s queue exceeded a certain limit, preventing excessive memory consumption.
However, TCP data marked as urgent could bypass this protection. An attacker connected to the node could continue sending information and grow the queue without limit. In practice, this made it possible to exhaust available memory and easily crash a vulnerable installation on Windows, macOS, or BSD.
The bug did not give the attacker access to private keys or allow them to create bitcoins. The risk was denial of service: the node would stop working, temporarily interrupting the verification and relaying of blocks and transactions.