.png){kind=logo}
Bitcoin Core has disclosed three security flaws identified through AI-assisted scanning, including one that could allow a malicious connection to crash Bitcoin nodes running Windows, macOS or BSD.
According to Bitcoin Core's October 28 security advisories, developers released fixes across four software versions on October 27 and 28. The findings came from Project Loupe, an automated review of the software's code using a large language model. Human contributors checked the findings before forwarding them to the security team.
The most direct threat involved how Bitcoin Core handled incoming network data on non-Linux computers. A connected attacker could send specially marked data that caused the software to keep storing messages even after its normal memory limit should have stopped the flow.
As a result, memory use could continue growing until the node crashed. Bitcoin Core rated the flaw medium severity and said Linux nodes were not affected. Project Loupe identified it on October 23, while contributor Gregory Sanders confirmed the finding that day. Developers merged a fix on October 26.
Bitcoin Core then released versions 31.2 and 32.1 on October 27, followed by versions 29.5 and 30.4 on October 28. All four contain the fix. A Bitcoin node checks transactions and blocks independently and exchanges information with other computers on the network.
Another medium-severity flaw allowed a connected computer to pretend it used an older Bitcoin communication method. By delaying the reading of messages, that computer could leave announcements accumulating in a node's memory without the usual timeout disconnecting it.
Bitcoin Core said memory use could rise by up to 2 MB an hour for each incoming connection and 5 MB for each outgoing connection. Project Loupe reported the issue on September 15. Developer L0rinc independently reported it six days later.
The third flaw concerned files that Bitcoin Core uses when the network replaces recent blocks with a competing chain. A miner could create blocks that caused those files to grow beyond their supported limits. The project rated this issue low severity because exploiting it on typical 64-bit systems would require thousands of specially constructed blocks and precise conditions.
However, affected Windows and 32-bit nodes could shut down repeatedly. Bitcoin Core warned that restarting alone would not resolve such a failure. The latest fixes protect supported 64-bit systems, but 32-bit machines and nodes using FAT32 storage remain exposed.
The disclosures followed a change Bitcoin Core announced on October 22. Previously, the project could delay publication of medium- and high-severity flaws for roughly a year after the first patched major release, allowing users more time to update.
Developer Antoine Poinsot said language models had made some software weaknesses easier to find again. "For these issues that are easy to find, this is the wrong tradeoff," he wrote to the Bitcoin development mailing list.
Under the revised policy, developers issue fixes for easily discoverable flaws across maintained versions as soon as possible and publish advisories alongside them. Other vulnerabilities retain their normal disclosure schedules. Poinsot also said three unrelated flaws would receive separate public advisories two weeks after the October 28 announcement.
ALSO READ: Nasdaq, S&P 500 Futures Gain as Chip Stocks Rally Following SK Hynix Earnings