[REVISION HISTORY]

Bitcoin Core security policy update and urgent patches

3 recorded revisions of this situation.

What changed

2026-10-29 18:47 UTC → 2026-11-03 03:02 UTC · added ~~removed~~

Bitcoin Core developers have revised the project’s security disclosure policy to address risks posed by artificial intelligence and large language models (LLMs). Developers noted that AI tools allow attackers to identify or rediscover software flaws with minimal effort, rendering traditional long disclosure embargoes less effective. Under the previous system, medium- and high-severity flaws often remained undisclosed for approximately one year to allow node operators time to upgrade. The updated policy, merged on October 22, introduces a category for ‘easily discoverable’ vulnerabilities. For these specific issues, developers will now aim to release patches across all maintained major versions and publish public security advisories as soon as possible, bypassing lengthy traditional embargo periods. Other vulnerabilities will continue to follow severity-based timelines: low-severity flaws will be disclosed two weeks after a fix, while medium- and high-severity issues will be disclosed approximately one year after the last affected version reaches end-of-life. Following this policy shift, the project released version 32.1 to address three vulnerabilities identified through automated source code analysis using LLMs. These include two medium-severity issues and one low-severity issue. One medium-severity flaw allows a malicious peer to crash nodes running on Windows, macOS, or BSD by exploiting TCP-Urgent data to exhaust memory. A second medium-severity flaw involves a peer pretending to use an outdated protocol, causing memory consumption to grow by approximately 2 MB per hour for incoming connections and 5 MB per hour for outgoing connections. A low-severity vulnerability involves a miner creating blocks that could cause file overflows during blockchain reorganizations, potentially crashing 64-bit systems. ~~While developers consider a successful attack on this third flaw difficult to execute, the updates provide critical protection.~~ Version 32.1 also introduces technical improvements such as faster block validation, reduced disk space usage, and enhanced privacy features via Tor. It includes a fix for potential IP-address exposure in specific private-broadcast fallback configurations and modifies outgoing transaction relay limits.

Versions

Select a version to see what changed compared to the one before it.