Bitcoin Core Software Update Aims for Speed and Security Patches
A release candidate for Bitcoin Core, the software that allows independent verification of Bitcoin transactions, has begun testing, with a final version targeted for October. The update aims to accelerate transaction verifications and address security vulnerabilities. According to the project’s schedule, Bitcoin Core 32.0 entered release-candidate testing on Monday, with developers targeting October 10 for the finished product. Testing could still alter that timeline.
The software known as Bitcoin Core is what allows computers to check Bitcoin transactions and blocks. This particular update mostly concerns node operators and developers, since they are the ones who rely on it to run wallets and other services.
What the Release Notes Say
Block checks can be sped up through parallel reading of database information, which leaves Bitcoin’s block production rate untouched. Four wallet commands will move toward a newer format for exchanging partially signed transactions between wallets and signing devices, even as applications can still ask for the older version.
The patch stops maliciously formed wallet names from launching commands on a node’s system. The vulnerability struck machines not running Windows, where an authorized user could produce wallets and the walletnotify setting was arranged to execute commands whenever a wallet transaction took place.
Another fix deals with the heavy memory consumption in the fresh HTTP server, which manages requests coming from linked applications.
Who Found the Memory Hole
Matthew Zipkin, who posts as pinheadmz, described a “memory exhaustion scenario” in his patch proposal. At first, he judged that the hazard was confined to users who had already proved their identity.
The flaw was discovered during an audit of Bitcoin Core’s new HTTP server, which Zipkin conducted with Kimi K3, an AI model employed by the Bitcoin Red Team to hunt down vulnerabilities in Bitcoin software. A prior fix had dealt with part of the issue, according to his account, yet a means of depleting the machine’s available memory—a “OOM,” or out-of-memory condition—still existed.
When reviewing the patch, GitHub user jeanpablojp discovered that requests arriving without credentials could also drive up memory use whenever the REST interface was turned on. After Zipkin adjusted the patch, the reviewer said that 16 unauthenticated connections led to roughly 3 MB of memory growth across 90 seconds, down from 3.2 GB beforehand.
Ongoing security improvements for Bitcoin Core 32.0 included a merged patch, which went in September 5.
Other Recent Fixes
In recent weeks, other Bitcoin software developers have been addressing their own separate security issues:
- A hardware-wallet maker called BitBox patched two serious firmware flaws in August, with no evidence of exploitation reported.
- The developers behind the payments software Core Lightning have also warned node operators about confirmed vulnerabilities while preparing fixes.
What Comes Next
The update’s goal is quicker verification, alongside shutting down crafted wallet names and heavy memory use. A patch for the HTTP server memory issue, discovered by Zipkin and examined by jeanpablojp, demonstrates just how cautious the review process has grown: one reviewer spotted a path that had already been partially repaired, and the current fix now applies to both authenticated and unauthenticated requests.
Get the Notebook.
The day's best stories and every fresh verdict, in plain English, in your inbox by seven. One email a day, no more.