Short version: Bitcoin Core published three vulnerability disclosures on October 28, 2026, and fixed releases are out in 29.5, 30.4, 31.2 and 32.1. The post is a fair summary, but the primary text is the Bitcoin Core advisories, so here is what each one says.
- Remote crash on non-Linux nodes: A malicious peer can exhaust memory and crash nodes on Windows, macOS and BSD. Coverage describes it as medium severity, and the advisory calls the conditions impractical. Linux is not affected.
- Slow memory growth: Pre-BIP31 peers can stay paused forever while the announcement queue grows. The advisory estimates up to 2 MB per hour per inbound peer and 5 MB per hour per outbound peer, so about 48 MB and 120 MB a day. Nodes running with -blocksonly are much less affected. Project Loupe found this one.
- Undo data corruption: A miner can overflow undo files past 2 GiB. The fix covers 64-bit systems. 32-bit systems and nodes on FAT32 remain affected, and the advisory calls exploitation impractical.
No CVEs were assigned, which departs from past practice. If you run a node, update to the release line you're on. Sources: Bitcoin Core advisory on memory growth and Bitcoin Core advisory on undo file overflow. Coverage by The Defiant and Crypto Briefing matches these details.
Also discussed here:
- Bitcoin Core ends months-long embargo on bugs an AI could rediscover
- Bitcoin wallet bug let rogue servers steal funds during fee bumps
- Jordan arrests three relatives over deadly church attack in Karak
🕒 As of October 2026
