CoinDesk
Bitcoin Core disclosed three vulnerabilities identified by an AI scan, including one that let a remote attacker exhaust memory and crash nodes running Windows, macOS or BSD. Developers verified the findings, issued fixes on Oct. 27 and published the details on Wednesday.
Why it matters
The disclosures are the first under a changed policy for bugs deemed “easily discoverable.” Previously, developers could keep medium-severity flaws confidential for up to a year to give node operators time to update. The new approach is to release fixes for supported versions as soon as possible, alongside public advisories, because language models have made some bugs cheaper to find.
The scan used a large language model to examine Bitcoin Core’s code, but human contributors checked every finding before it reached the security team. One flaw had also been found independently by a developer six days after the scan’s report on Sept. 15. It could let a connected node pose as running an outdated protocol version and then stall, with messages consuming memory at up to 2MB an hour per incoming connection and 5MB per outgoing connection.
Market impact
The third disclosed bug was rated low severity and involved crafted blocks that could overflow files used during a chain reorganization. On 64-bit machines, the attack would require roughly a month of the network’s entire block production. Windows and 32-bit systems could fail outright; restarting would not resolve the issue. Nodes on 32-bit machines or using older FAT32 drives remain exposed even after the fix.
The disclosures concern the reliability and security of Bitcoin infrastructure, not a change to Bitcoin’s protocol or a reported market move. Bitcoin Core’s release notes say three more medium- and high-severity vulnerabilities, already fixed in version 30.0, are expected to be disclosed in two weeks.
Frequently asked questions
-
What could the most serious Bitcoin Core flaw let an attacker do?
A remote attacker could send data that exhausted memory and crashed Bitcoin nodes running Windows, macOS or BSD.
-
Why is Bitcoin Core changing how it discloses easily discoverable bugs?
The project says language models have made some bugs cheaper to find, so fixes for supported versions should be released as soon as possible with public advisories.
-
How were the AI scan's vulnerability findings checked?
Human contributors verified every finding before it reached Bitcoin Core's security team.
-
Which systems may remain exposed to the low-severity block-file flaw?
Nodes on 32-bit machines or storing blocks on older FAT32 drives remain exposed even after the fix.
-
When are more Bitcoin Core vulnerabilities expected to be disclosed?
Three additional medium- and high-severity vulnerabilities fixed in Bitcoin Core version 30.0 are expected to be disclosed in two weeks.
Crypto News
Crypto Capital Venture
CoinTelegraph
WuBlockchain
CryptoSlate