Bitcoin Core discloses three bugs found by AI scan, one able to crash nodes on Windows and macOS

Compiled from reports by CoinDesk, Cryptonews and Crypto.news. See the original articles linked below.

Bitcoin Core has publicly disclosed three security vulnerabilities that were found through an automated scan using artificial intelligence, according to CoinDesk and Cryptonews. Cryptonews, which republished a report from The Defiant, put the disclosure date at Oct. 28. CoinDesk's article is dated Oct. 29.

The three flaws

CoinDesk reported that the most significant bug lets a remote attacker connected to a node running Windows, macOS or BSD flood it with data until it runs out of memory and crashes. Cryptonews rated this flaw medium severity and wrote that it works by sending TCP urgent data to get around limits on incoming data. It said Linux is not affected, because that system monitors connections differently. CoinDesk said the issue was flagged on Oct. 23 and fixes shipped on Oct. 27.

The second bug, which Cryptonews also rated medium, involves a malicious peer pretending to use an old protocol version without modern pings, so it avoids timeouts while the node keeps queuing announcements. Cryptonews reported that memory can grow by as much as 2 MB an hour for each inbound peer and 5 MB an hour for each outbound peer. CoinDesk wrote that the scan's finding was reported on Sept. 15 and that another developer found the same flaw independently six days later.

The third, rated low severity by Cryptonews, concerns the undo files a node keeps for chain reorganizations. CoinDesk said a miner could craft blocks that overflow these files. It reported that on 64-bit machines the attack would take about a month of the network's block production, while on Windows and 32-bit systems a node can fail outright, and it quoted the advisory as saying restarting does not help. Cryptonews wrote that Bitcoin Core considers exploitation impractical on 64-bit systems and that the fix does not cover 32-bit systems or nodes using FAT32 storage.

Who found them and how

Cryptonews attributed the findings to an automated scan by Spiral's Project Loupe, validated by Gregory Sanders. CoinDesk wrote that the scan used a large language model to review the code and that human contributors checked each finding before it reached the security team.

Fixes and policy

According to Cryptonews, fixes are included in Bitcoin Core versions 29.5, 30.4, 31.2 and 32.1.

Both bugs were disclosed under a revised security policy. CoinDesk reported that since Oct. 22 Bitcoin Core discloses bugs it considers easily discoverable quickly, instead of keeping medium-severity flaws private for up to a year. Crypto.news, in an Oct. 24 report on the policy, wrote that the fast route covers vulnerabilities that are easy to rediscover, including through a simple prompt to an AI model. It added that maintainers plan to release a point version for each supported major release together with a public advisory, and that the other disclosure timelines remain in place. Crypto.news also described a debate among developers: Antoine Poinsot argued that withholding fixes for easily found bugs gives little protection, while Antoine Riard warned that a broad alert could prompt rushed upgrades by operators who are not affected.

CoinDesk added that three further medium and high-severity vulnerabilities, fixed in version 30.0, are expected to be disclosed in about two weeks.

Sources

This article was compiled with AI assistance from the reports listed above and reviewed by GMA before publishing.