---
title: "Bitcoin Core Patches Memory Exhaustion Bug on Non-Linux Systems"
description: "Vulnerability allowed attackers to crash Windows, macOS, and BSD nodes via TCP urgent data."
url: https://basisdesk.news/news/bitcoin-core-patches-memory-exhaustion-bug-non-linux
published: 2026-10-28T18:26:30.782Z
modified: 2026-10-28T18:26:30.782Z
section: Security & Hacks
author: Basis Desk Newsroom (AI-generated, source-verified)
sentiment: neutral
tickers: [BTC]
tags: [bitcoin-core, vulnerability, node-security, open-source]
license: Quote with attribution to Basis Desk (basisdesk.news). Not financial advice.
---

# Bitcoin Core Patches Memory Exhaustion Bug on Non-Linux Systems

Vulnerability allowed attackers to crash Windows, macOS, and BSD nodes via TCP urgent data.

## At a glance

- **What happened:** Bitcoin Core released security updates across four major branches to resolve a memory exhaustion vulnerability on non-Linux platforms on Oct. 28.
- **Why it matters:** The bug allowed malicious peers to bypass backpressure safeguards and crash Windows, macOS, and BSD nodes via TCP urgent data packets.
- **Who is affected:** Bitcoin Core node operators running versions 29 through 32 on Windows, macOS, or BSD operating systems.
- **What's next:** Node operators running affected operating systems must upgrade to versions 29.5, 30.4, 31.2, or 32.1.
- **Primary source:** [Unbounded memory growth through TCP urgent data on non-Linux systems](https://bitcoincore.org/en/2026/10/28/disclose-tcp-oom/) — Bitcoin Core

## Key points

- A medium-severity flaw in Bitcoin Core enabled peers to exhaust node memory on non-Linux platforms using TCP urgent data.
- The issue impacted socket backpressure mechanisms using select() on Windows, macOS, and BSD, leaving Linux systems unaffected.
- Fixes have been deployed across Bitcoin Core releases 29.5, 30.4, 31.2, and 32.1 following discovery via Project Loupe.

## Editorial remark

- **Context:** Bitcoin Core maintains separate socket polling routines for cross-platform compatibility, exposing non-Linux builds to an unhandled exceptional condition.
- **Impact:** Windows, macOS, and BSD node operators face potential remote denial-of-service crashes until upgrading to patched software versions.
- **Watch:** Adoption rates of maintenance releases 29.5, 30.4, 31.2, and 32.1 across the public node network.

Bitcoin Core developers published a disclosure on Oct. 28 detailing a medium-severity vulnerability that permitted malicious peers to crash nodes operating on non-Linux operating systems by forcing out-of-memory errors [1]. Patches resolving the issue were deployed across Bitcoin Core versions 29.5, 30.4, 31.2, and 32.1 following a coordinated release schedule [1].

The vulnerability stems from differences in how the software monitors socket events across operating systems [1]. While Linux systems employ `poll()`, non-Linux platforms—including Windows, macOS, and BSD—rely on a backend based on `select()` [1]. Under standard operation, Bitcoin Core limits data queuing per peer by pausing socket reads once buffers reach a set threshold [1]. However, the `select()` implementation continued to monitor sockets for exceptional states even while reads were suspended [1]. By transmitting TCP urgent (out-of-band) packets, an attacker could trigger an unmonitored read, bypassing the backpressure controls and causing unbounded memory accumulation until the node crashed [1]. Linux installations were unaffected by the defect [1].

## Automated Discovery and Patch Timeline

The flaw was initially identified through an automated large language model audit conducted under Project Loupe, an initiative led by Elias Rohrer at Spiral [1]. Researcher Gregory Sanders verified the automated finding and alerted the Bitcoin Core security team on Oct. 23 [1]. Developer Antoine Poinsot subsequently opened pull request #36665 on Oct. 26 to remediate the socket handling, which was promptly merged and backported across four major release branches [1]. Releases 31.2 and 32.1 rolled out on Oct. 27, followed by versions 29.5 and 30.4 alongside the public security advisory on Oct. 28 [1].

At the time of writing, $BTC traded at $80,709. Node operators running non-Linux environments are urged to update to the supported patch releases to prevent remote denial-of-service disruptions [1].

## Sources

1. [Unbounded memory growth through TCP urgent data on non-Linux systems](https://bitcoincore.org/en/2026/10/28/disclose-tcp-oom/) — Bitcoin Core, 2026-10-28

---
Basis Desk Newsroom · AI-generated, source-verified · https://basisdesk.news/about/how-we-use-ai