What happened
On 28 October 2026, Bitcoin Core published three security advisories for bugs found by Project Loupe, an automated language-model scan run by Spiral and checked by human contributors. Two bugs can exhaust a node's memory. The third can corrupt undo data under extreme conditions. Fixes are available in Bitcoin Core 29.5, 30.4, 31.2 and 32.1.
The most direct attack affects Windows, macOS and BSD nodes. A malicious peer could use TCP urgent data to bypass the limit on queued incoming data, keep adding bytes to memory and crash the process. Linux uses a different socket backend and is not affected by this specific path.
Bitcoin Core rated that bug Medium. Project Loupe reported it on 23 October, Gregory Sanders validated it the same day, and Antoine Poinsot opened the fix on 26 October. Releases 31.2 and 32.1 followed on 27 October, with 29.5 and 30.4 on 28 October.
What it changes
The second Medium bug applies across operating systems. Bitcoin Core pauses a peer that reads too slowly, but it kept adding transaction announcements to that peer's outgoing queue. A peer claiming not to support BIP 31 pings could avoid the normal timeout and leave the queue growing without a bound.
The advisory estimates growth of up to 2 MB per hour for each inbound peer and 5 MB per hour for each outbound peer. Nodes using -blocksonly are much less affected because they do not relay most transaction announcements. The fix disconnects peers whose queued data reaches the limit, including peers without BIP 31 support.
The third bug concerns undo files, which hold the data a node needs to reverse recent blocks during a chain reorganisation. File positions used 32-bit values. A miner able to fill one undo file past the limit could overwrite earlier positions and make the node shut down when the affected block was disconnected. On Windows and 32-bit systems, the file write could fail earlier and force a shutdown without a reorganisation.
The project rated this bug Low because an attack against a typical 64-bit node would require several thousand specially constructed blocks and a precise reorganisation. The fix uses 64-bit positions on supported systems.
Node operators should verify their download from Bitcoin Core's official site and move to the fixed point release for their branch. The 30.4 release notes identify the three backported fixes.
What it does not change
The advisories do not report exploitation. They describe ways to stop a node, not ways to steal private keys, create bitcoin or bypass transaction validation. A wallet user who does not run Bitcoin Core has no software update to perform for these bugs.
Linux is exempt only from the TCP urgent-data path. Linux nodes remain affected by the slow outgoing-queue growth and the undo-file bug if they run vulnerable versions.
The undo-file fix also has a stated limit. Nodes on 32-bit systems, or storing block files on FAT32, remain affected. Operators in either case need to migrate to a supported 64-bit system and filesystem rather than treating a point release as a complete remedy.
Version 29.5 fixes these three bugs, but the 29.x branch is now end of life. Installing the patch closes these disclosed paths; moving to a maintained branch is the safer long-term choice for future security fixes.
Context
These are the first disclosures under Bitcoin Core's new fast path for flaws considered easy to rediscover. Our October 22 report covered that policy before any specific bug was public. This follow-up covers the first patched releases and the operator action they require.
Three independent newsrooms checked the advisories. CoinDesk described the non-Linux crash and the human review of the scan. TFTC compared all three timelines and reported no observed exploitation. Unchained checked the fixed versions, platform limits and disclosure exception.
The reports agree on the affected mechanisms and releases. None establishes how many reachable nodes remain vulnerable, and the project has not said that any of the bugs was used against a live node.