Bitcoin Core discloses three LLM-found bugs, one crashing non-Linux nodes
Victoria Shinder2 min readBitcoin Core published three security advisories on 28 October, one day after shipping the fixes, under the policy it adopted the week before for bugs it rates as easily discoverable. All three were found by an automated scan with a large language model, part of Elias Rohrer's Project Loupe, and validated by contributor Gregory Sanders before they reached the security team.
The most serious, CVE-2026-117350, rated medium, affects nodes on Windows, macOS and BSD. On those platforms Bitcoin Core monitors sockets with a select()-based backend rather than poll(), and that path watched for exceptional socket conditions even when reads from a peer were paused. Sending TCP urgent, or out-of-band, data triggered a read anyway, letting a peer bypass the per-peer queue limit. The advisory says a malicious peer could "trivially crash" any such node it is connected to. Linux nodes are not affected. Project Loupe reported it on 23 October; the fix was merged on 26 October and backported to versions 29 to 32.
The second, CVE-2026-117349, also medium, involves peers that claim not to support BIP 31 nonced pings. Such peers are not disconnected for failing to answer pings, so a malicious one could delay reading and let its queue of transaction announcements grow by up to 2 MB an hour per inbound connection and 5 MB per outbound one. Contributor L0rinc found the same flaw independently six days after the scan.
The third, CVE-2026-117346, rated low, lets a miner inflate undo files past 32-bit offsets. On 64-bit systems the advisory calls it impractical, requiring roughly a month of the network's block production and a precisely placed reorg. On Windows and 32-bit systems it can stop a node outright at 2 GiB, and restarting does not help. Fixes are in 29.5, 30.4, 31.2 and 32.1; 32-bit systems and nodes storing blocks on FAT32 remain affected.
What it means
The case for the new policy is in the second advisory: a bug a machine found in September was found again by a human within a week. Keeping such flaws secret for months protects little once scanning is cheap. Operators of non-Linux nodes reachable from the internet should treat the upgrade as urgent; the project also says three more medium and high severity bugs fixed in 30.0 will be disclosed in two weeks.