Bitcoin Core has released version 29.5 with fixes for three newly disclosed node vulnerabilities, including two memory-exhaustion paths and an edge-case storage bug. According to the official Bitcoin Core 29.5 release notes, the October 28 maintenance release hardens peer networking and file-position handling rather than introducing major new protocol features. The same security corrections were also shipped across newer maintained branches through versions 30.4, 31.2 and 32.1.
One of the Medium-severity vulnerabilities allowed malicious peers to gradually consume unbounded memory by exploiting connections that did not support BIP31 nonced pings. A peer could remain paused indefinitely while Bitcoin Core continued adding transaction announcements to its outbound queue, causing memory consumption to grow by as much as 2 MB per hour for each inbound peer and 5 MB per hour for each outbound peer. Nodes using -blocksonly were substantially less exposed because transaction announcements generated most of the queued data.
Non-Linux Nodes Faced a Separate Remote Crash Path
A second Medium-severity issue affected Bitcoin Core’s socket-monitoring behavior on platforms using the select() backend. Linux uses a different poll() path and was not affected. A malicious connected peer could send TCP urgent data to bypass Bitcoin Core’s normal backpressure mechanism and force unbounded data into memory, making it possible to crash Windows, macOS and BSD nodes through memory exhaustion.
Version 29.5 addresses the problem by aligning exception monitoring between the poll() and select() networking backends. The vulnerability reinforces the distinction between implementation-level node failures and problems with Bitcoin consensus itself. Similar boundaries matter when Core Lightning vulnerabilities expose individual node implementations without compromising the Bitcoin base network. The newly disclosed Bitcoin Core bugs affected specific software behavior rather than Bitcoin’s transaction or consensus rules.
Both memory vulnerabilities were identified through automated security research associated with Project Loupe at Spiral and subsequently validated before disclosure. AI-assisted vulnerability discovery has also surfaced actionable flaws in Core Lightning’s security review process. Automated discovery can expand code-review coverage, but each reported issue still requires human validation before it can be treated as an exploitable software defect.
Undo File Bug Remains on Some Storage Configurations
The third vulnerability involves Bitcoin Core’s undo data, which nodes use when disconnecting blocks during reorganizations. Positions inside undo files had been stored using 32-bit integers even though those files could theoretically grow beyond 4 GiB. Under an extreme sequence of specially constructed blocks, a miner could cause the recorded file position to overflow and corrupt undo-data references, potentially forcing affected nodes to shut down during a later reorganization.
Bitcoin Core rates that issue Low severity because exploiting it would require substantial block preparation and tightly controlled conditions. Version 29.5 changes flatfile positions to 64-bit integers on supported systems, but 32-bit environments and nodes storing blocks on FAT32 remain exposed to the underlying size limitation. The project describes practical exploitation as difficult rather than impossible.
The release arrives after a broader period of Bitcoin software changes, including lower default relay-fee settings introduced in Bitcoin Core 30.0 and continuing networking work in newer branches. Version 29.5 should therefore be understood as a security-oriented maintenance backport for an older branch, not the newest Bitcoin Core generation. Bitcoin Core 32.1 is currently the latest release, while the project’s lifecycle guidance recommends running the latest maintenance release of the newest major version an operator can support.
The October security disclosures do not report confirmed exploitation of these three vulnerabilities in the wild. Their significance lies instead in removing remotely triggerable resource-exhaustion paths and an unusual storage failure before they become practical tools for disrupting individual Bitcoin nodes.