Bitcoin Core Patches Memory Exhaustion Bug on Non-Linux Systems

Bitcoin Core developers published a disclosure on Oct. 28 detailing a medium-severity vulnerability that permitted malicious peers to crash nodes operating on non-Linux operating systems by forcing out-of-memory errors ¹. Patches resolving the issue were deployed across Bitcoin Core versions 29.5, 30.4, 31.2, and 32.1 following a coordinated release schedule ¹.

The vulnerability stems from differences in how the software monitors socket events across operating systems ¹. While Linux systems employ poll(), non-Linux platforms—including Windows, macOS, and BSD—rely on a backend based on select() ¹. Under standard operation, Bitcoin Core limits data queuing per peer by pausing socket reads once buffers reach a set threshold ¹. However, the select() implementation continued to monitor sockets for exceptional states even while reads were suspended ¹. By transmitting TCP urgent (out-of-band) packets, an attacker could trigger an unmonitored read, bypassing the backpressure controls and causing unbounded memory accumulation until the node crashed ¹. Linux installations were unaffected by the defect ¹.

Automated Discovery and Patch Timeline

The flaw was initially identified through an automated large language model audit conducted under Project Loupe, an initiative led by Elias Rohrer at Spiral ¹. Researcher Gregory Sanders verified the automated finding and alerted the Bitcoin Core security team on Oct. 23 ¹. Developer Antoine Poinsot subsequently opened pull request #36665 on Oct. 26 to remediate the socket handling, which was promptly merged and backported across four major release branches ¹. Releases 31.2 and 32.1 rolled out on Oct. 27, followed by versions 29.5 and 30.4 alongside the public security advisory on Oct. 28 ¹.

At the time of writing, $BTC traded at $80,709. Node operators running non-Linux environments are urged to update to the supported patch releases to prevent remote denial-of-service disruptions ¹.