Bitcoin Core Reveals Three Vulnerabilities Found by AI Scan

Bitcoin Core identified three vulnerabilities found by an AI-based scan. One of them allowed any computer connected to a Bitcoin node on Windows, macOS, or BSD to flood it with data until memory was exhausted and it crashed. This was reported by CoinDesk.

The vulnerability was identified by the AI scan on October 23, developers confirmed it the same day, released fixes on October 27, and published details on Wednesday along with two other bugs from the same scan.

A node is a program that verifies and transmits every Bitcoin transaction; Bitcoin Core is the most common software for nodes. Until last week, developers kept medium-risk vulnerabilities secret for up to a year to allow operators to update before attackers learned where to look. On October 22, the rule was changed for bugs that the project considers "easily detectable": their fixes are now released as quickly as possible for all supported versions with public notification.

All three bugs were found by an automated scan that combed through Bitcoin Core's code using a language model. Each finding was verified by a human before being passed to the security team.

The second and third vulnerabilities

The second bug illustrates why the rules were changed. The scan reported it on September 15, and six days later, another developer independently found the same issue. The vulnerability allowed a connected node to claim it was running on an outdated protocol version and then hang: messages accumulated in the victim's memory at a rate of up to 2 MB per hour for each incoming connection and up to 5 MB per hour for each outgoing one.

The third bug, of low severity, surfaced three times: in the scan and in two separate developer reports in August and on October 23. A miner could form blocks that overflow files the node keeps for reorganization when the network replaces several recent blocks with a competing set. On 64-bit machines, the attack would take about a month of the network's entire block production. On Windows and 32-bit systems, the node could completely fail, and "restarting does not help," the notification states. Nodes on 32-bit machines or with blocks on old FAT32 disks remain vulnerable even after the fix.

The release notes indicate that three more medium and high-severity bugs fixed in version 30.0 will be disclosed in two weeks.