Bitcoin Core has patched a medium-severity vulnerability that could allow a malicious peer to crash nodes running Windows, macOS or BSD. Tracked as CVE-2026-117350, the issue affects how the software handles TCP urgent, or out-of-band, data on non-Linux systems.
A connected peer could send this data while normal reads were paused, bypassing the limit on queued network data and driving memory usage high enough to crash the node. Bitcoin Core says Linux systems are not affected because they use a different socket-monitoring backend.
The flaw was identified on October 23 by Project Loupe, an automated large language model scanning project run by Spiral. Bitcoin Core’s security advisory says Gregory Sanders validated the finding and brought it to the project’s security team. Developers merged a fix on October 26, followed by patched releases on October 27 and 28. The fix is included in Bitcoin Core versions 29.5, 30.4, 31.2 and 32.1.
The project disclosed three vulnerabilities on October 28 under its revised policy for easily discoverable bugs. The policy says issues that can be found with minimal effort, including through a simple LLM prompt, should be disclosed once fixed releases are available for maintained major versions instead of remaining under the usual severity-based embargo periods. Bitcoin Core explains the approach on its security advisory policy page.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
