The software that lets users independently verify Bitcoin payments is getting an update aimed at speeding up those checks and fixing security flaws, with a release targeted for October.
Bitcoin Core 32.0 entered release-candidate testing on Monday, according to the project’sschedule. Developers are aiming for October 10 to deliver the finished version, though testing could change that timeline.
Bitcoin Core lets computers verify Bitcoin transactions and blocks. The update mainly affects node operators and developers who use the software to run wallets and other services.
According to thedraft release notes, the update can speed up block checks by reading database information in parallel, without changing how quickly Bitcoin produces blocks. Four wallet commands will also default to a newer format for exchanging partially signed transactions between wallets and signing devices, though applications can still request the older version.
A security fix prevents crafted wallet names from triggering commands on a node’s computer. The flaw affected non-Windows systems where an authenticated user could create wallets and the walletnotify feature was configured to run commands when wallet transactions occurred.
A separate patch addresses excessive memory use in the new HTTP server, which handles requests from connected applications.
Contributor Matthew Zipkin, posting as pinheadmz, described a “memory exhaustion scenario” in hispatch proposal. His initial assessment limited the risk to authenticated clients.
Zipkin said he found the flaw while auditing Bitcoin Core’s new HTTP server with Kimi K3, an AI model alsoused by the Bitcoin Red Team to search for vulnerabilities in Bitcoin software. An earlier fix had addressed part of the problem, he explained, but a way to exhaust the computer’s available memory—an “OOM,” or out-of-memory, condition—remained.
During review of that same patch, GitHub user jeanpablojp found that requests without credentials could also cause memory growth when the REST interface was enabled. After Zipkin revised the patch, the reviewer reported that 16 unauthenticated connections caused about 3 MB of memory growth over 90 seconds, compared with 3.2 GB before.
The patch was merged September 5 for Bitcoin Core 32.0 as part of ongoing work to improve the software’s security.
Other Bitcoin software developers have addressed separate vulnerabilities in recent weeks. Hardware-wallet maker BitBoxpatched two severe firmware flaws in August, reporting no evidence of exploitation. Developers of the payments software Core Lightning alsowarned node operators about confirmed vulnerabilities while preparing fixes.
