Do Son 
A single remote computer can crash full cryptocurrency nodes across multiple platforms. Specifically, researchers uncovered a Bitcoin Core DoS vulnerability that enables severe memory exhaustion. The defect affects nodes operating on Windows, macOS, and BSD operating systems. Consequently, an unauthenticated peer can force an out-of-memory crash without local operating system access. Furthermore, executing this attack requires only a standard peer-to-peer network connection.
- CVE: CVE-2026-117350
- CVSS: Awaiting analysis
- Product: n/a
- Affected: n/a
- Status: No confirmed exploitation yet
- Action: See vendor advisory
TCP Socket Handling and Queue Bypass Flaws
Bitcoin Core serves as the foundational software engine powering the decentralized Bitcoin network. These distributed nodes validate transactional histories and consensus blocks independently. However, a subtle flaw inside the network transport layer compromises service reliability. On non-Linux platforms, the application relies on the system select() call to monitor active sockets. When incoming message queues hit defined memory thresholds, the daemon pauses reading incoming traffic.
Urgent Out-of-Band Data Triggers Unbounded Consumption
Unfortunately, the select() event handler continued listening for exceptional socket alerts after pausing standard reads. By transmitting urgent TCP out-of-band packets, an adversary easily forces the socket into an active reading state. Therefore, subsequent inbound messages bypass queue capacity restrictions entirely. Consequently, unconstrained network traffic accumulates inside system RAM until the host exhausts physical memory. In contrast, Linux distributions employ poll() system calls and remain completely immune to this vector.
Rapid AI Discovery and Five-Day Remediation
Security analysts discovered the flaw on October 23, 2026. Remarkably, the discovery emerged from Project Loupe, an automated code analysis engine powered by language models. Security researcher Elias Rohrer from Spiral created the diagnostic platform. Afterward, Gregory Sanders verified the computational finding and alerted the core security team immediately. This successful discovery highlights the growing role of synthetic intelligence in modern source code auditing.
Core developer Antoine Poinsot swiftly engineered a robust code patch within seventy-two hours. As detailed in the official Bitcoin Core security advisory, developers backported fixes across supported release branches. Maintainers published updated binaries for versions 31.2, 32.1, 29.5, and 30.4 within five days of initial discovery. Furthermore, telemetry confirms zero in-the-wild exploitation against active network infrastructure. Crucially, the vulnerability does not compromise private keys, steal cryptocurrency, or undermine cryptographic consensus rules. Ultimately, system operators running Bitcoin Core on Windows, macOS, or BSD should install updated releases immediately.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
