Bitcoin Core fixes flaw that can crash remote nodes

Bitcoin Core’s CVE-2026-117350 is a denial-of-service flaw that can let an unauthenticated remote peer exhaust memory and crash a node. SecurityOnline says the issue affects Bitcoin Core running on Windows, macOS and BSD, and can be triggered over a standard peer-to-peer connection. It reports no confirmed exploitation; the CVSS score is awaiting analysis.

The flaw lies in TCP socket handling on non-Linux systems. When message queues reach their memory limits, Bitcoin Core pauses normal reads, but its `select()` event handler continues monitoring exceptional socket alerts. An attacker can send urgent TCP out-of-band packets to make a socket readable, allowing incoming messages to bypass queue limits and accumulate in RAM. The report says Linux systems use `poll()` and are not affected by this attack.

Security researcher Elias Rohrer of Spiral reportedly discovered the issue on 23 October 2026 using Project Loupe, an automated code analysis tool, and Gregory Sanders verified the finding before notifying Bitcoin Core’s security team. The official advisory says fixes were backported, with updated binaries released as versions 31.2, 32.1, 29.5 and 30.4. Bitcoin Core developers say the vulnerability does not expose private keys, enable theft of cryptocurrency or alter consensus rules.