Bitcoin Core 32.1, 31.2, 30.4 and 29.5: three flaws fixed

On 28 October 2026 the Bitcoin Core project disclosed three vulnerabilities and pointed to releases that fix them: 32.1, published a day earlier, and the maintenance releases 31.2, 30.4 and 29.5. None of the three exposes private keys or lets anyone take coins. Two can make a node run out of memory and crash; the third can stop a node after a block reorganisation under extreme conditions. They matter most to people who run their own node, including those who connect a hardware wallet to it.

What was fixed?

Advisory	Severity (project’s rating)	Who is affected	What can happen
CVE-2026-117349: paused pre-BIP31 peers	Medium	Nodes before the fixed versions	The send queue to a paused peer that does not support BIP31 pings can grow without limit; the advisory gives rates of up to 2 MB an hour per inbound peer and 5 MB an hour per outbound peer. Nodes running with -blocksonly are less affected
CVE-2026-117350: TCP urgent data	Medium	Builds using the select() network backend on systems other than Linux: Windows, macOS and BSD	A peer can send TCP urgent data to bypass the node’s read pausing and exhaust its memory, crashing it. Linux is not affected
CVE-2026-117346: undo file overflow	Low	64-bit and 32-bit builds before the fix	A miner could push 32-bit positions in the undo files past 4 GiB, causing a shutdown during a later reorganisation until the node is reindexed. On Windows and 32-bit systems, undo writes fail past 2 GiB. The project describes exploitation on 64-bit systems as impractical; 32-bit systems and nodes on FAT32 remain affected after the fix

According to the advisories, all three were found by Project Loupe, which the project describes as an automated scan using a large language model, and were reported through Gregory Sanders; two also credit L0rinc, and the undo-file issue credits Andrew Dorman.

How serious is this for an ordinary holder?

For someone who keeps coins on a hardware wallet and uses a third-party wallet app, these advisories change nothing directly: the bugs are in the node software, not in key handling. For someone who runs Bitcoin Core at home, especially on Windows or macOS, the TCP urgent data issue is the one to act on, because an outside peer could crash the node remotely.

A crashed node does not lose coins. It does stop validating and relaying until it is restarted, and a wallet that relies on it will show stale information in the meantime.

What should node operators do?

1. Update to 32.1, 31.2, 30.4 or 29.5, whichever matches the branch you run, downloading only from bitcoincore.org and verifying the release signatures.
2. On 32-bit hardware or a FAT32 disk, note that the undo-file issue is not fully fixed for you. The advisory’s guidance is to move to a 64-bit system.
3. Read the advisory for your platform before relying on workarounds such as -blocksonly, which reduces exposure to one issue but changes what your node relays.

In this case the fixed releases were already published when the details were disclosed, so a node kept up to date within a supported release branch was protected before the advisories went public. Our general checklist is in what to do when a wallet vulnerability is announced.