Bitcoin Core Fixes Medium-Severity Memory Growth Bug Across Older Versions

Bitcoin Core developers disclosed a medium-severity vulnerability on Oct. 28 involving unbounded memory consumption triggered by legacy network peers ¹. The flaw, which allowed paused connections to indefinitely accumulate transaction announcements, was resolved across multiple software releases, specifically versions 29.5, 30.4, 31.2, and 32.1 ¹. At the time of writing, $BTC traded at $80,835.

The vulnerability stemmed from how Bitcoin Core manages backpressure for slow-reading peers ¹. When an outgoing message buffer crosses a preset limit, the node marks that peer as paused for transmission purposes ¹. Although paused, the node continued to append certain messages, notably frequent transaction inventory notifications, to the queue ¹. Under typical conditions, non-responsive connections are severed after failing to answer a nonced ping within 20 minutes ¹. However, nodes lacking BIP 31 support bypassed this disconnection mechanism entirely ¹. An attacker could simulate a pre-BIP31 client and deliberately delay message consumption, leading to continuous memory accumulation of up to 2MB hourly for inbound peers and 5MB hourly for outbound connections ¹. Nodes configured with the -blocksonly flag experienced significantly reduced exposure because transaction announcements constituted the bulk of queued data ¹.

Automated Auditing and Timeline

The vulnerability was initially flagged on Sept. 15 through Project Loupe, an automated large language model audit framework led by Elias Rohrer at Spiral ¹. Spiral contributor Gregory Sanders verified the report and notified the Bitcoin Core security team that same day ¹. A researcher known as L0rinc independently identified the flaw and reported it to Sanders on Sept. 21 ¹. The fix follows earlier maintenance addressing client stability, including when Bitcoin Core Patches Memory Exhaustion Bug on Non-Linux Systems.

Mitigation work began on Oct. 26 when developer Antoine Poinsot submitted pull request #36667, which was merged and backported across maintenance branches 29, 30, 31, and 32 ¹. Bitcoin Core versions 31.2 and 32.1 were distributed on Oct. 27, followed by releases 29.5 and 30.4 on Oct. 28 alongside the public disclosure ¹. Node operators running impacted versions are advised to update to secure their instances against potential denial-of-service attempts ¹.