# Bitcoin Core 29.5, 30.4, 31.2 and 32.1 fix three AI-found bugs, including a remote crash of Windows, macOS and BSD nodes · pwn.watch > Bitcoin Core published three advisories on Oct 28 2026 for bugs first found by an automated LLM scan (Elias Rohrer's Project Loupe at Spiral) and validated by Gregory Sanders. The worst, rated Medium: on platforms other than Linux, a malicious peer can send TCP urgent (out-of-band) data to bypass read backpressure and queue unlimited data, which Bitcoin Core says lets it "trivially crash any Windows, macOS or BSD node it is connected to". A second Medium bug lets a peer that claims not to support BIP 31 pings stay paused forever while its message queue grows (up to 2MB per hour per inbound peer, 5MB per hour per outbound peer). A Low-severity undo-file overflow lets a miner corrupt other nodes' undo data, impractical on 64-bit systems. All three are fixed in 29.5, 30.4, 31.2 and 32.1 and were disclosed early under Core's new policy for "easily discoverable" bugs. Page: https://pwn.watch/i/bitcoin-core-ai-found-node-crash-bugs-oct-2026 · generated 2026-10-29T12:29:19.972Z ## Status - Severity: medium · status: live · patch: patched - Product: Bitcoin Core - Started: 2026-10-28 - Affected: Bitcoin Core before 29.5, 30.4, 31.2 and 32.1 (TCP urgent-data bug: Windows, macOS and BSD only; Linux not affected) - Fixed in: Bitcoin Core 29.5; Bitcoin Core 30.4; Bitcoin Core 31.2; Bitcoin Core 32.1 (undo-file overflow stays unfixed on 32-bit systems and nodes storing blocks on FAT32) ## Follow this incident - RSS (one item per update): https://pwn.watch/i/bitcoin-core-ai-found-node-crash-bugs-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/bitcoin-core-ai-found-node-crash-bugs-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/bitcoin-core-ai-found-node-crash-bugs-oct-2026.json - This file: https://pwn.watch/i/bitcoin-core-ai-found-node-crash-bugs-oct-2026/llms.txt ## Updates (newest first) - 2026-10-28: Bitcoin Core discloses the three bugs (TCP urgent-data OOM, paused pre-BIP31 peer memory growth, undo-file overflow) with fixes in 29.5, 30.4, 31.2 and 32.1. Release notes say three more medium and high severity bugs fixed in 30.0 will be disclosed in two weeks. (https://bitcoincore.org/en/security-advisories/) - 2026-10-23: Project Loupe's LLM scan flags the TCP urgent-data memory bug; Gregory Sanders validates it and notifies the Bitcoin Core security team the same day. (https://bitcoincore.org/en/2026/10/28/disclose-tcp-oom/) ## Fix brief # Security brief: Bitcoin Core 29.5, 30.4, 31.2 and 32.1 fix three AI-found bugs, including a remote crash of Windows, macOS and BSD nodes Source: https://pwn.watch/i/bitcoin-core-ai-found-node-crash-bugs-oct-2026 · status: live · severity: medium · updated Oct 29, 2026, 10:20 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is Bitcoin Core published three advisories on Oct 28 2026 for bugs first found by an automated LLM scan (Elias Rohrer's Project Loupe at Spiral) and validated by Gregory Sanders. The worst, rated Medium: on platforms other than Linux, a malicious peer can send TCP urgent (out-of-band) data to bypass read backpressure and queue unlimited data, which Bitcoin Core says lets it "trivially crash any Windows, macOS or BSD node it is connected to". A second Medium bug lets a peer that claims not to support BIP 31 pings stay paused forever while its message queue grows (up to 2MB per hour per inbound peer, 5MB per hour per outbound peer). A Low-severity undo-file overflow lets a miner corrupt other nodes' undo data, impractical on 64-bit systems. All three are fixed in 29.5, 30.4, 31.2 and 32.1 and were disclosed early under Core's new policy for "easily discoverable" bugs. Severity detail: Bitcoin Core rates two bugs Medium and one Low; the TCP urgent-data bug lets any connected peer crash non-Linux nodes; no exploitation reported - Product: Bitcoin Core ## Affected versions - Bitcoin Core before 29.5, 30.4, 31.2 and 32.1 (TCP urgent-data bug: Windows, macOS and BSD only; Linux not affected) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - Bitcoin Core 29.5 - Bitcoin Core 30.4 - Bitcoin Core 31.2 - Bitcoin Core 32.1 (undo-file overflow stays unfixed on 32-bit systems and nodes storing blocks on FAT32) After upgrading, re-run the checks above and redeploy/restart the affected services. ## Specific notes Upgrade Bitcoin Core to 29.5, 30.4, 31.2 or 32.1. Nodes on Windows, macOS or BSD are the priority, since any connected peer can crash them with the TCP urgent-data bug; Linux nodes are not affected by that one. Running with -blocksonly greatly reduces the pre-BIP31 memory growth. 32-bit nodes and nodes storing blocks on FAT32 stay exposed to the undo-file overflow even after upgrading, so move them to 64-bit and a modern filesystem. A node already hit by the undo overflow needs a -reindex with a fixed version. ## Latest updates - Oct 28, 2026: Bitcoin Core discloses the three bugs (TCP urgent-data OOM, paused pre-BIP31 peer memory growth, undo-file overflow) with fixes in 29.5, 30.4, 31.2 and 32.1. Release notes say three more medium and high severity bugs fixed in 30.0 will be disclosed in two weeks. - Oct 23, 2026: Project Loupe's LLM scan flags the TCP urgent-data memory bug; Gregory Sanders validates it and notifies the Bitcoin Core security team the same day. ## Advisories - [Unbounded memory growth through TCP urgent data on non-Linux systems](https://bitcoincore.org/en/2026/10/28/disclose-tcp-oom/) (Bitcoin Core) - [Slow unbounded memory growth on paused pre-BIP31 peers](https://bitcoincore.org/en/2026/10/28/disclose-fpausesend-oom/) (Bitcoin Core) - [Undo file overflow under extreme conditions](https://bitcoincore.org/en/2026/10/28/disclose-undo-overflow/) (Bitcoin Core) - [Bitcoin Core 32.1 release notes](https://bitcoincore.org/en/releases/32.1/) (Bitcoin Core) ## Write-ups & news - [AI found a way to crash bitcoin nodes on Windows and Macs. It's now public](https://www.coindesk.com/tech/2026/10/29/ai-found-a-way-to-crash-bitcoin-nodes-on-windows-and-macs-it-s-now-public) --- Machine-readable: https://pwn.watch/i/bitcoin-core-ai-found-node-crash-bugs-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.