Monitor this situation.
Unsubscribe anytime.
[SITUATION] · [QUIET] · [TECHNOLOGY]
4 clusters · 25 sources · 10 days · First seen · Last updated
Bitcoin Core security policy update and urgent patches
Overview
Bitcoin Core developers have revised the project’s security disclosure policy to address risks posed by artificial intelligence and large language models (LLMs). Developers noted that AI tools allow attackers to identify or rediscover software flaws with minimal effort, rendering traditional long disclosure embargoes less effective.
Under the previous system, medium- and high-severity flaws often remained undisclosed for approximately one year to allow node operators time to upgrade. The updated policy, merged on October 22, introduces a category for ‘easily discoverable’ vulnerabilities. For these specific issues, developers will now aim to release patches across all maintained major versions and publish public security advisories as soon as possible, bypassing lengthy traditional embargo periods. Other vulnerabilities will continue to follow severity-based timelines: low-severity flaws will be disclosed two weeks after a fix, while medium- and high-severity issues will be disclosed approximately one year after the last affected version reaches end-of-life.
Following this policy shift, the project released version 32.1 to address three vulnerabilities identified through automated source code analysis using LLMs. These include two medium-severity issues and one low-severity issue. One medium-severity flaw allows a malicious peer to crash nodes running on Windows, macOS, or BSD by exploiting TCP-Urgent data to exhaust memory. A second medium-severity flaw involves a peer pretending to use an outdated protocol, causing memory consumption to grow by approximately 2 MB per hour for incoming connections and 5 MB per hour for outgoing connections. A low-severity vulnerability involves a miner creating blocks that could cause file overflows during blockchain reorganizations, potentially crashing 64-bit systems.
Version 32.1 also introduces technical improvements such as faster block validation, reduced disk space usage, and enhanced privacy features via Tor. It includes a fix for potential IP-address exposure in specific private-broadcast fallback configurations and modifies outgoing transaction relay limits.
Entities
Bitcoin Core · Antoine Poinsot · Karlsruhe Institute of Technology · Elias Rohrer · Spiral
Timeline
-
[TECHNOLOGY] 2 sourcesBitcoin Core releases version 32.1 with privacy fixes
Bitcoin Core 32.1 has been released, featuring privacy fixes for IP-address exposure, new transaction relay limits, and interface changes that require integration checks by node operators.
-
[TECHNOLOGY] 8 sourcesBitcoin Core releases security updates to fix AI-discovered vulnerabilities
Bitcoin Core has released version 32.1 to patch three security vulnerabilities discovered by AI-driven automated analysis, including flaws that could crash certain operating systems.
-
[TECHNOLOGY] 6 sourcesBitcoin Core updates security policy due to AI vulnerability risks
Bitcoin Core has updated its security policy to fast-track patches for vulnerabilities easily identified by AI tools, moving away from long disclosure embargoes.
-
[TECHNOLOGY] 13 sourcesBitcoin Core updates security policy to address AI-driven vulnerability discovery
Bitcoin Core is accelerating security patches and public disclosures for vulnerabilities that are easily identified by AI and large language models, moving away from traditional long-term disclosure embargoes.
Sources
bitcoin.fr · blockchainreporter.net · blockonomi.com · blocktempo.com · btc-echo.de · btcnews.com · coindeskjapan.com · coinpaper.com · criptonoticias.com.br · cryptobreaking.com · cryptoticker.io · finex.cz · ibj.org · insidebitcoins.com · kryptouutiset.net · livecoins.com.br · merca2.es · news.bitcoin.com · newsbtc.com · positioniseverything.net · rande-academy.cz · spacemoney.com.br · techreport.com · tokenpost.com · unchainedcrypto.com
This summary has been updated 3 times: see revision history