--- title: "Bitcoin Core Fixes Medium-Severity Memory Growth Bug Across Older Versions" description: "Developers resolved a queue accumulation flaw affecting pre-BIP31 peers that allowed unbounded memory leaks up to 5MB per hour." url: https://basisdesk.news/news/bitcoin-core-fixes-unbounded-memory-growth-bug-pre-bip31-peers published: 2026-10-28T18:31:25.629Z modified: 2026-10-28T18:31:25.629Z section: Tech & Protocols author: Basis Desk Newsroom (AI-generated, source-verified) sentiment: neutral tickers: [BTC] tags: [bitcoin, bitcoin-core, software-security, node-operators, spiral] license: Quote with attribution to Basis Desk (basisdesk.news). Not financial advice. --- # Bitcoin Core Fixes Medium-Severity Memory Growth Bug Across Older Versions Developers resolved a queue accumulation flaw affecting pre-BIP31 peers that allowed unbounded memory leaks up to 5MB per hour. ## At a glance - **What happened:** Bitcoin Core released security updates for versions 29, 30, 31, and 32 on Oct. 27 and Oct. 28 to fix an unbounded memory leak bug. - **Why it matters:** Malicious peers pretending to lack BIP 31 support could delay message reading and trigger persistent memory consumption up to 5MB per hour. - **Who is affected:** Bitcoin Core node operators running vulnerable releases without the -blocksonly configuration. - **Takes effect:** 2026-10-28 - **What's next:** No next step announced. - **Primary source:** [Slow unbounded memory growth on paused pre-BIP31 peers](https://bitcoincore.org/en/2026/10/28/disclose-fpausesend-oom/) — Bitcoin Core ## Key points - Bitcoin Core resolved an unbounded memory growth flaw across maintenance versions 29.5, 30.4, 31.2, and 32.1 on Oct. 27 and Oct. 28 [1]. - A malicious peer mimicking pre-BIP31 status could leak up to 2MB hourly inbound and 5MB outbound due to unexercised 20-minute ping timeouts [1]. - Spiral's automated LLM tool Project Loupe first flagged the issue on Sept. 15 before an independent rediscovery on Sept. 21 [1]. ## Editorial remark - **Context:** Bitcoin Core relies on BIP 31 nonced pings to disconnect inactive or unresponsive peers after 20 minutes, a fail-safe that was not applied to legacy pre-BIP31 connections. - **Impact:** Node operators running versions prior to 29.5, 30.4, 31.2, or 32.1 face potential memory exhaustion attacks, though instances running -blocksonly are largely shielded. - **Watch:** Adoption rates of the newly released patch versions across public Bitcoin node tracking dashboards. Bitcoin Core developers disclosed a medium-severity vulnerability on Oct. 28 involving unbounded memory consumption triggered by legacy network peers [1]. The flaw, which allowed paused connections to indefinitely accumulate transaction announcements, was resolved across multiple software releases, specifically versions 29.5, 30.4, 31.2, and 32.1 [1]. At the time of writing, $BTC traded at $80,835. The vulnerability stemmed from how Bitcoin Core manages backpressure for slow-reading peers [1]. When an outgoing message buffer crosses a preset limit, the node marks that peer as paused for transmission purposes [1]. Although paused, the node continued to append certain messages, notably frequent transaction inventory notifications, to the queue [1]. Under typical conditions, non-responsive connections are severed after failing to answer a nonced ping within 20 minutes [1]. However, nodes lacking BIP 31 support bypassed this disconnection mechanism entirely [1]. An attacker could simulate a pre-BIP31 client and deliberately delay message consumption, leading to continuous memory accumulation of up to 2MB hourly for inbound peers and 5MB hourly for outbound connections [1]. Nodes configured with the `-blocksonly` flag experienced significantly reduced exposure because transaction announcements constituted the bulk of queued data [1]. ## Automated Auditing and Timeline The vulnerability was initially flagged on Sept. 15 through Project Loupe, an automated large language model audit framework led by Elias Rohrer at Spiral [1]. Spiral contributor Gregory Sanders verified the report and notified the Bitcoin Core security team that same day [1]. A researcher known as L0rinc independently identified the flaw and reported it to Sanders on Sept. 21 [1]. The fix follows earlier maintenance addressing client stability, including when [Bitcoin Core Patches Memory Exhaustion Bug on Non-Linux Systems](https://basisdesk.news/news/bitcoin-core-patches-memory-exhaustion-bug-non-linux). Mitigation work began on Oct. 26 when developer Antoine Poinsot submitted pull request #36667, which was merged and backported across maintenance branches 29, 30, 31, and 32 [1]. Bitcoin Core versions 31.2 and 32.1 were distributed on Oct. 27, followed by releases 29.5 and 30.4 on Oct. 28 alongside the public disclosure [1]. Node operators running impacted versions are advised to update to secure their instances against potential denial-of-service attempts [1]. ## FAQ **Which Bitcoin Core versions contain the fix?** The fix was released in Bitcoin Core versions 29.5, 30.4, 31.2, and 32.1. **How did the vulnerability exhaust memory?** Peers falsely claiming not to support BIP 31 avoided the standard 20-minute inactivity disconnect, allowing queued transaction announcements to pile up without limit. ## Sources 1. [Slow unbounded memory growth on paused pre-BIP31 peers](https://bitcoincore.org/en/2026/10/28/disclose-fpausesend-oom/) — Bitcoin Core, 2026-10-28 --- Basis Desk Newsroom · AI-generated, source-verified · https://basisdesk.news/about/how-we-use-ai