The Bitcoin Core team disclosed three vulnerabilities on 28 October 2026 after an automated scanner using a large language model identified them. One medium-severity flaw could let a connected attacker cause unbounded memory growth and potentially crash nodes on Windows, macOS and BSD; Linux nodes were not affected by that flaw. A second flaw could raise memory use when a connected node claimed to use an outdated protocol version.
A third, low-severity flaw could crash some nodes if miners created blocks that overflowed files used for reorganizations and a matching reorganization later occurred. On Windows and 32-bit systems, a crash could occur without that reorganization. Fixes were released in versions 29.5, 30.4, 31.2 and 32.1, but the fix does not fully eliminate the third issue on 32-bit systems or for nodes storing blocks on older FAT32 drives. The team also changed its disclosure policy to publish advisories for easily discovered flaws once fixes are available for supported major versions.
