AI Scanner Finds Three Bitcoin Core Security Flaws—and Developers Move Fast to Patch Them
•
October 29, 2026 4:05 pm
•
Comments
Bitcoin Core developers have shipped fixes for three security flaws discovered by an automated AI scanning project, including two bugs that could exhaust a node’s memory and force it offline.
The most immediate issue matters to operators running Bitcoin Core on Windows, macOS or BSD. According to the official Bitcoin Core security advisory, a malicious peer could send TCP urgent data that bypassed the software’s normal backpressure limit.
Memory could then keep growing until the node crashed. Linux nodes are not affected by that particular flaw because they use a different socket-monitoring path.
The bug is tracked as CVE-2026-117350 and was rated medium severity. Fixes were released in Bitcoin Core 29.5, 30.4, 31.2 and 32.1.
The advisory says the problem was both easy to discover and practical to exploit against a connected vulnerable node, which helps explain the compressed patch schedule.
Bitcoin Core v32.1 was released!
It is available from: https://t.co/WpMuMaejz1
Release notes: https://t.co/hWQTLpfGBl— Bitcoin Core Project (@bitcoincoreorg) October 28, 2026
CryptoSlate reported that the disclosures cover two medium-severity memory-exhaustion bugs and one low-severity file-position overflow issue. A second memory bug involved communication with older peers that lack a network feature introduced under Bitcoin Improvement Proposal 31. The third concerned undo files used during blockchain reorganizations and would require unusually difficult conditions to trigger on modern 64-bit systems.
All three findings came from Project Loupe, an automated large-language-model security scanner developed by Elias Rohrer at Spiral. Gregory Sanders validated the reports and brought them to the Bitcoin Core security team.
The TCP urgent-data flaw was found on October 23, patched three days later and publicly disclosed after fixed releases became available.
That timeline is a useful case study in what AI security tooling can do well. The scanner did not make the final call, write the public advisory or independently prove the exploit.
It surfaced suspicious code paths quickly enough for experienced developers to validate the risk, build the fix and coordinate releases.
After a drawn out 32.x release cycle, we’ve shipped 32.1. v32.0 was tagged, but not fully announced/released, and after this last-minute discovery: https://t.co/kWkkIS9T4r we decided to ship v32.1, which fixes this bug, along with others (below) and includes other minor… https://t.co/fvFiqt66xP
— Michael Ford (@fanquake) October 28, 2026
Bitcoin Core maintainer Michael Ford said version 32.0 had been tagged but was not fully announced or released. The late discovery pushed the team to ship 32.1 instead, bundling the security corrections with other minor fixes.
That decision avoided promoting a release already known to contain a remotely triggerable problem.
There was no reported active exploitation in the disclosures. That should not be mistaken for a reason to wait.
Nodes help validate transactions, relay blocks and keep operators independently connected to the network. A remote crash bug does not need to steal coins to be disruptive.
Operators on affected platforms should move to a fixed maintained release and review the compatibility notes before upgrading. The broader lesson is just as important: AI-assisted code review is becoming capable of finding real flaws in critical open-source infrastructure, but the strongest results still come from pairing automated discovery with human validation and disciplined release engineering.
Join the conversation!
We have no tolerance for comments containing violence, racism, profanity, vulgarity, doxing, or discourteous behavior. If a comment is spam, instead of replying to it please click the icon below and to the right of that comment. Thank you for partnering with us to maintain fruitful conversation.