Bitcoin Core ships four versions to patch three vulnerabilities

Bitcoin Core released four patched versions across two days — 31.2 and 32.1 on October 27, 29.5 and 30.4 on October 28 — closing out three vulnerabilities that weren’t disclosed publicly until after the fixes had already shipped.

The fact sheet identifies a third issue, an undo-file overflow, but the supplied disclosures do not provide its technical specifics or severity.

The first memory issue, tagged fpausesend-oom, caused unbounded memory growth on paused peers, and it hit harder on peers that don’t support BIP 31 nonced ping messages. Bitcoin Core puts the growth rate at up to 2MB per hour per inbound peer and 5MB per hour per outbound peer, compounding to as much as 48MB and 120MB respectively over 24 hours. Memory use scales with each affected peer connection. Bitcoin Core classifies it Medium severity and marks it as easily discoverable.

The second flaw has its own TCP urgent-data disclosure. A malicious peer could push TCP urgent (out-of-band) data to nodes running on platforms that use theselect() socket-monitoring backend — Windows, macOS and BSD. The disclosure identifies Windows, macOS and BSD systems using the select() backend as affected platforms; it does not characterize Linux in the supplied material. Bitcoin Core rates this one the same way: Medium severity, easily discoverable.

Both memory vulnerabilities came out of automated LLM scans run under Elias Rohrer’s Project Loupe at Spiral. Project Loupe flagged fpausesend-oom on September 15 and tcp-oom on October 23. Gregory Sanders received notification on each, validated the reports, and passed them to the Bitcoin Core security team.

Antoine Poinsot opened PR #36667 for fpausesend-oom and PR #36665 for tcp-oom on October 26. Both merged the same day and were backported across versions 29, 30, 31 and 32. Bitcoin Core 29.5 is available for download.

Nodes still on the affected release lines carry the disclosed memory risks until operators upgrade to 29.5, 30.4, 31.2 or 32.1. Operators on affected release lines should upgrade immediately; until they do, their nodes remain exposed to the disclosed memory-exhaustion flaws. The supplied disclosures do not detail the technical specifics, severity, or exposure of the undo-file overflow issue. The patched versions were out by October 28, the same day the two memory vulnerabilities went public. No prior comparable vulnerability disclosure event is available in the supplied material.

BTC$79,976.00▼1.75% Bitcoin was trading at $80,016 on October 29, down 1.1% over 24 hours, per CoinGecko — a move unrelated to the software releases.