Bitcoin Core discloses 3 AI-found bugs that can crash nodes

Key points

• Bitcoin Core disclosed three AI-found bugs on Oct. 28
• One medium-severity flaw can crash Windows, macOS and BSD nodes
• Fixes are in Core 29.5, 30.4, 31.2 and 32.1
• First disclosures under Core's rule for easily discoverable bugs

Bitcoin Core developers on Oct. 28 publicly disclosed three vulnerabilities found with the help of an AI-driven code scan, including a medium-severity flaw that lets a malicious peer crash nodes running on Windows, macOS and BSD. Patched releases are available, according to the project’s security advisory.

The disclosures are the first made under a policy Core adopted this month for bugs it considers easy to discover, CoinDesk reported. Under the change, such flaws are published soon after fixes ship rather than held back for as long as a year.

The remote crash bug on non-Linux nodes

The most serious of the three involves TCP urgent data. According to the advisory, a malicious peer can use it to get around per-peer read limits and drive a node out of memory. Linux nodes are not affected because they use a different network backend. The project rates the issue medium severity and “easily discoverable.”

The advisory credits an automated large-language-model scan in Project Loupe, run by Elias Rohrer at Spiral. Gregory Sanders validated the finding and reported it to the security team on Oct. 23. A fix was merged on Oct. 26 and backported to the 29, 30, 31 and 32 release lines.

Two further flaws: memory buildup and undo-file overflow

CoinDesk reported a second bug in which a connected node claims an outdated protocol version and stalls, causing messages to accumulate in memory. The outlet cited rates of up to 2MB per hour per incoming connection and 5MB per hour per outgoing connection. It said another developer found the issue independently six days after it was first reported on Sept. 15.

The third flaw is rated low severity. Per its advisory, a miner could push a block undo file past 4 GiB, and a later chain reorganization involving an affected block would force a node to shut down. Recovery requires a reindex using a fixed version. The project says exploiting this on 64-bit systems is impractical.

On Windows and on 32-bit systems, undo writes can fail once a file passes 2 GiB, with no reorganization needed. The fix addresses Windows, but 32-bit systems and nodes storing blocks on FAT32 drives remain affected, the advisory says. Those nodes fail to write undo data and shut down on every restart. Project Loupe found the issue, and two developers, L0rinc and Andrew Dorman, reported it independently.

Fixed versions and what comes next

The fixes shipped in Bitcoin Core 31.2 and 32.1 on Oct. 27, and in 29.5 and 30.4 on Oct. 28. Node operators on affected platforms can upgrade to the release that matches their version line. The advisories describe no loss of funds; the impact is on node availability.

CoinDesk said three more medium- and high-severity bugs are expected to be disclosed in about two weeks. Bitcoin Core publishes all disclosures on its security advisories page.