Bitcoin Core Bugs: What You Need to Know About Recent Vulnerabilities and Their Impact on Your Coins

Bitcoin Core Faces New Vulnerabilities: What You Need to Know

In a recent announcement, Bitcoin Core, the essential software that powers the Bitcoin network, revealed three newly patched bugs that could potentially crash nodes—computers running the software that maintain the network’s integrity. The project has also made a notable change in how it discloses vulnerabilities, raising questions about the implications for Bitcoin holders.

On October 28, Bitcoin Core confirmed that fixes for the vulnerabilities are available in four updated versions: 29.5, 30.4, 31.2, and 32.1. Despite the severity of the issue, the market’s reaction has been surprisingly muted, with Bitcoin trading at $80,626, down just 0.5% in the past 24 hours. This calm response seems to reflect a general sense of security among those who do not operate nodes.

Understanding the Bugs

Two of the three identified bugs, classified as medium severity, are related to memory exhaustion. Designated as CVE-2026-117349 and CVE-2026-117350, these vulnerabilities allow an attacker to send specific data to a node, potentially exhausting its memory and causing it to cease functioning. Notably, the second bug particularly affects nodes running operating systems other than Linux.

The third bug, deemed low severity, involves an overflow in undo data, which is crucial for rolling back recent blocks in the blockchain if necessary. Fortunately, no attacks have been reported on live nodes, although Bitcoin Core has not disclosed how many nodes are still operating on the affected versions.

Who Should Update?

Only those running a “full node”—which downloads and verifies every block independently—need to install the updated versions. For Bitcoin holders keeping their assets on exchanges, in hardware wallets, or using light wallets (which rely on external nodes), no action is required. Even if a node crashes, it does not compromise private keys, ensuring that coins remain secure.

Exchanges and custodians managing Bitcoin Core nodes will handle the necessary updates for their clients. However, hobbyists running home nodes and businesses operating nodes for customers must take immediate action to safeguard their systems.

A Shift in Disclosure Policy

In a significant policy change, Bitcoin Core now shares bug information only after fixes are implemented, ensuring that attackers are informed only after users can protect themselves. This shift, suggested by developer Antoine Poinsot, aims to leverage AI tools that can quickly identify vulnerabilities, making it less effective to keep bugs secret.

While the project has historically faced more severe flaws—such as a vulnerability in September 2018 that could have allowed users to create excess Bitcoin—these new bugs are relatively minor. The decentralized nature of the network, with multiple independent nodes running different versions and operating systems, further mitigates the risk of a single bug compromising the entire system.

Should You Be Concerned?

For most Bitcoin holders, the answer is no—unless you operate a node. The recent fixes are viewed as routine maintenance for node operators and pose no risk to the majority of users’ coins. Node operators are encouraged to update to one of the new versions to ensure continued security.

However, the situation could change if Bitcoin Core publishes a follow-up advisory indicating that any of the identified vulnerabilities have been exploited in live nodes. Until then, holders can rest easy, facing no new risks related to these vulnerabilities.

For further inquiries or corrections, please contact [email protected].