Bitcoin Core discloses AI-found node crash flaws under new security policy

Traders Union
All News
Crypto
Bitcoin Core AI-found node flaws

Highlights

Bitcoin Core disclosed three node-crashing vulnerabilities on Oct. 27 after AI-assisted scans flagged issues later verified and fixed by developers.
The most severe flaw allowed remote memory exhaustion across Windows, macOS, and BSD nodes, while another bug caused memory buildup at rates up to 5MB per hour per connection.
The project's new accelerated disclosure policy responds to AI-driven vulnerability discovery, with three more medium- and high-severity bugs from version 30.0 to be revealed in two weeks.

New disclosure policy follows AI-assisted findings

As reported by CoinDesk, Bitcoin Core published details of the three flaws after human contributors verified the automated findings and developers shipped fixes on Oct. 27. The project says bugs it considers "easily discoverable" now receive faster disclosure because large language models have made them cheaper and quicker to find.

The most serious of the newly disclosed issues was first flagged by an AI scan on Oct. 23 and could allow any computer connected to a bitcoin node on Windows, macOS or BSD to flood it with data until it runs out of memory and crashes. A second flaw, reported to the project on Sept. 15, let a connected node claim it was running an outdated version of the protocol and then stall, causing messages to accumulate in memory at up to 2MB an hour for each incoming connection and 5MB an hour for each outgoing one.

The third issue, rated low severity, was identified three times, once in the scan and twice by developers in August and on Oct. 23. It could let a miner craft blocks that overflow the files a node uses during a blockchain reorganization, when the network replaces several recent blocks with a competing chain.

Operational risks for node operators

A node runs the software that validates and relays bitcoin transactions, and Bitcoin Core remains the software used by most nodes. Under the project’s previous practice, medium-severity flaws could remain undisclosed for as long as a year to give operators time to upgrade before attackers learned the technical details.

The newly disclosed bugs illustrate why the policy has changed. Bitcoin Core says one of the flaws was independently found by another developer six days after it was first reported, while the low-severity reorganization bug was also discovered separately by two developers outside the scan process.

The advisory adds that the third flaw could take roughly a month of the network’s entire block production to exploit on 64-bit machines. On Windows and 32-bit systems, however, a node can fail outright and restarting does not help, while nodes running on 32-bit machines or storing blocks on older FAT32 drives remain exposed even after the fix.

Release notes for Bitcoin Core version 30.0 also say three additional medium- and high-severity vulnerabilities fixed in that version are due to be disclosed in two weeks.

In our earlier article on the Bank of England’s push for “bare metal” recovery, we explained why regulators want banks to plan for independent fallback systems that can keep critical services running if primary technology is compromised. We noted that rapid advances in AI are increasing the scale and complexity of cyber attacks, prompting supervisors to demand deeper end-to-end resilience and recovery options rather than relying on perimeter defences alone.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.