Bitcoin Core developers released security updates on October 27–28, 2026, after an automated language-model scan identified three vulnerabilities in the widely used Bitcoin node software. Human contributors validated the findings, and fixes shipped in versions 32.1, 31.2, 30.4 and 29.5. Two issues were rated medium severity and one low, according to Bitcoin Core’s official advisories.

The discoveries came from Elias Rohrer’s Project Loupe at Spiral and reflect a changing security environment: bugs cheap for AI tools to find may also be cheap for attackers to rediscover. Bitcoin Core had already announced its accelerated disclosure policy; these are its first prominent applications.

What the three flaws could do

The first issue, CVE-2026-117350, allowed a connected malicious peer to exhaust memory on Windows, macOS or BSD nodes using a particular socket backend. The advisory says Linux nodes were not affected by that specific bug. The second, CVE-2026-117349, let stalled older-protocol peers accumulate outbound announcements without a firm limit.

For the second bug, developers estimated memory growth of up to 2 MB per hour per inbound peer and 5 MB per hour per outbound peer. These are upper estimates for vulnerable connections, not measurements of overall Bitcoin network memory use.

The third flaw, CVE-2026-117346, concerned oversized block-undo files under highly contrived mining conditions. Bitcoin Core called exploitation impractical. Its fix addresses 64-bit file offsets, but 32-bit systems and nodes storing blocks on FAT32 remain affected by related storage limits—an important distinction from general FAT32 performance improvements.

Why the release matters

The project tagged Bitcoin Core 32.0 but never fully released it because of last-minute issues; 32.1 became the published version. Earlier release-candidate testing had focused on broader feature changes. This week’s fixes instead demonstrate why independent full-node operators need ongoing security maintenance.

Node operators should review the official upgrade instructions, verify their actual running version and follow a suitable maintenance process. Version 29.x has reached end of life despite receiving this final patch. These are node availability and data-handling vulnerabilities, not evidence that Bitcoin’s consensus rules were breached or users’ coins were stolen. The project says three additional medium/high issues fixed earlier will be disclosed later under its normal schedule.

For context, a previous Electrum wallet patch involved different software and a different risk; Bitcoin Core fixes likewise should not be confused with Core Lightning’s separate security updates.

Editor’s Note: We volunteer daily to ensure the credibility of the information on this platform is Verifiably True. If you would like to support our work and help further secure the integrity of our research initiatives, please scan the QR code below to donate 5,000 sats.

For mobile scanning, open this story on a laptop or larger display and scan with a compatible Bitcoin wallet. Confirm the destination before sending: 3C9o19EH5HSiwEPyCTmEKzxhNCbo2X6TTb.

BitcoinVersus.tech is not a financial advisor. This media platform reports on financial subjects purely for informational purposes.