All three bugs came out of an automated scan which used a large language model to comb through Bitcoin Core’s code. Afterward, every finding was checked by a human contributor before it reached the project’s security team.
The second bug shows why Core changed its rules. The scan’s finding was reported to the project on Sept. 15, and six days later another developer found the same flaw independently. It let a connected node claim to run an outdated version of the protocol and then stall. Messages piled up in the victim’s memory at up to 2MB an hour for each incoming connection and 5MB an hour for each outgoing one, the advisory said.
The third bug, rated low severity, turned up three times: in the scan and in two separate reports from developers, in August and on Oct. 23. A miner could craft blocks that overflow the files a node keeps for a reorganization, which is when the network swaps out a few recent blocks for a competing set.
On 64-bit machines the attack would take roughly a month of the network’s entire block production. On Windows and 32-bit systems the node can fail outright, and “restarting does not help,” the advisory says. Nodes on 32-bit machines, or storing blocks on older FAT32 drives, stay exposed even after the fix.
Leave a Reply