Bitcoin Core has publicly disclosed three software vulnerabilities identified through an automated scan that used a large language model to review the codebase. One of the flaws could allow a remote peer to overwhelm nodes running on Windows, macOS or BSD with data until they ran out of memory and crashed.

The disclosures follow a policy change announced on Oct. 22. Instead of keeping some medium-severity issues private for up to a year, the project said bugs it considers easy to discover will now be published soon after fixes are shipped to supported versions.

One flaw could crash nodes on several operating systems

The most serious issue in this batch affected Bitcoin Core nodes on Windows, macOS and BSD. According to the project, any machine connected to a vulnerable node could keep sending data until the target exhausted available memory and stopped running.

Developers said the issue was first flagged by an AI-assisted scan and then confirmed by human contributors the same day. Fixes were released before the vulnerability details were made public on Wednesday.

A second bug reinforced the case for faster disclosure

The second vulnerability involved a connected node presenting itself as if it were using an outdated protocol version and then stalling. As traffic accumulated, memory usage on the victim could continue to grow, with the advisory saying messages could build up at as much as 2MB per hour for each incoming connection and 5MB per hour for each outgoing connection.

Bitcoin Core said this finding illustrated why its disclosure practice is changing. The flaw was initially reported from the automated scan, and six days later a separate developer independently found the same problem.

A lower-severity issue could still cause lasting failures

The third disclosed bug was rated low severity, but the project said it was also found repeatedly: once by the scan and twice by developers, in August and again on Oct. 23. In this case, a miner could create blocks that overflow the files a node keeps to handle a blockchain reorganization, when recent blocks are replaced by a competing chain.

Bitcoin Core said the attack would require roughly a month of the network's full block production on 64-bit systems. On Windows and 32-bit machines, however, a node could fail completely, and restarting would not resolve the problem. The project added that nodes running on 32-bit systems, or using older FAT32 storage for blocks, remain exposed even after the software fix.

Why the policy changed

Bitcoin Core is the software used by most bitcoin nodes, which validate and relay transactions across the network. Until last week, the project's usual approach was to keep medium-severity vulnerabilities undisclosed for as long as a year so operators had time to upgrade before attackers knew what had been fixed.

That policy now excludes bugs the project considers easy to uncover. Core developers said large language models have made such flaws cheaper and faster to find, reducing the value of long delays between patching a bug and publicly describing it.

More disclosures are expected soon

The release notes for Bitcoin Core version 30.0 say three additional medium- and high-severity vulnerabilities were also fixed and are scheduled to be disclosed in two weeks.

For the current batch, the project said every AI-generated finding was reviewed by a human contributor before it was escalated to the security team, underscoring that the published advisories cover issues that were verified rather than raw machine output.

Source: www.coindesk.com