Skip to content
Blockchain Posts

protocol

Bitcoin Core 32.1 ships three fixes; LLM-assisted scan surfaced two of them

Core releases 32.1 and backports 31.2, 30.4 and 29.5 after an automated LLM scan flagged a non-Linux TCP memory flood and a stalled pre-BIP31 peer queue bug.

by 4 min read
protocolresearchbitcoinsecurity

Bitcoin Core shipped v32.1 on October 27 and backported fixes to 31.2, 30.4 and 29.5 the next day. Two medium-severity advisories dated October 28 describe memory-growth bugs that let a remote peer stall a node until it runs out of RAM; a third note covers a reorg undo-file overflow. The project credits an automated large-language-model scan with surfacing two of the three.

What shipped

Two primary advisories are live on bitcoincore.org:

  • Slow unbounded memory growth on paused pre-BIP31 peers (medium). Core queues inventory announcements for every peer, paused ones included. A peer that advertises a pre-BIP31 protocol version and stays paused keeps its queue growing without bound. Reported September 15.
  • Unbounded memory growth through TCP urgent data on non-Linux systems (medium). On platforms whose socket backend uses select() — Windows, macOS and BSD — a malicious peer can push a node to OOM by sending TCP urgent (out-of-band) data. Flagged October 23 and fixed in the October 27 release.

A third note, labeled low severity, covers an undo-file overflow under extreme conditions: a miner who crafts thousands of blocks and triggers a precisely timed short reorganization can push the reorg undo files past their size assumptions and crash the node. The bug surfaced in August and again on October 23; the fix narrows exposure to Windows and 32-bit systems, with nodes running on FAT32 drives still exposed afterwards.

The LLM angle

Core's write-up says the automated bug-hunt ran "a large-language-model-based scan" over the codebase; the project does not name the model or the tool. Each finding was reviewed by a human contributor before a fix was written. The TCP-urgent bug was found by the scan alone; the stalled-peer queue issue was independently rediscovered by a developer, and the undo-file overflow came from two separate developer reports.

These are the first advisories to ship under the policy change Core announced on October 22. Previously, medium-severity flaws could sit under embargo for up to a year. Under the new rule, bugs the project judges "easily discoverable" — including anything an LLM-driven scan would catch — are patched on all supported release branches and disclosed as fast as the fix can be reviewed. The 36-hour gap between the October 27 advisory and the October 28 backport releases is the policy in action.

What to do

  1. Node operators on 32.0 should upgrade to 32.1. Operators pinned to a long-term branch should take 31.2, 30.4 or 29.5.
  2. Windows, macOS and BSD mainnet nodes carry the highest exposure on the TCP-urgent bug and should upgrade first.
  3. Nodes running on FAT32 are still exposed to the undo-file bug after the patch; move the data directory to a filesystem without FAT32's size limits.
  4. Operators who rely on inbound Tor or peer scoring should audit for pre-BIP31 peers; a node sitting on the current advisory load with a flood of such peers is a near-term OOM candidate.

Context

The faster-disclosure policy was contested when it was announced. The counter-argument on the mailing list was that releasing one easy flaw by name is a nudge to anyone running the same automated tooling. These two advisories test it: both bugs are memory-exhaustion primitives in widely deployed binaries, no exploitation is reported, and the backported fixes landed on every supported branch inside two days of public disclosure. The reorg undo-file overflow is the harder of the three to weaponise — it needs mining capacity and tightly timed reorgs — but it also demonstrates that an LLM pass can find bugs that two human researchers found independently years apart.

Sources

Related stories