Bitcoin Core 32.0 Hits the Home Stretch: Faster, Tighter, and One Memory Leak Off the Wallet 🛠️

Bitcoin Core 32.0, the reference implementation that lets computers independently verify $BTC payments and blocks, moved into release-candidate testing on Monday, with developers targeting October 10 for final delivery. The update is aimed principally at node operators, developers, and services that run wallets on top of the software. Draft release notes describe changes to internal database reads that allow block checks to run in parallel, shortening verification time without altering Bitcoin's block production interval.

Four wallet commands will default to a newer partially signed transaction format, though applications will still be able to request the previous version. A security fix blocks crafted wallet names from triggering commands on a node's host. The flaw affected non-Windows systems in which an authenticated user could create wallets and the walletnotify feature had been configured to execute commands when wallet transactions occurred.

A separate patch, merged September 5 for Bitcoin Core 32.0, addresses an HTTP server memory exhaustion condition. Contributor Matthew Zipkin, posting as pinheadmz, first described the "memory exhaustion scenario" in his patch proposal, initially assessing the risk as limited to authenticated clients. Zipkin said he identified the flaw while auditing Bitcoin Core's new HTTP server with Kimi K3, an AI model also used by the Bitcoin Red Team to search for vulnerabilities in Bitcoin software. An earlier fix had partially addressed the issue, but an out-of-memory, or OOM, path remained.

During review of that patch, GitHub user jeanpablojp found that credential-less requests could also drive memory growth when the REST interface was enabled. After Zipkin revised the patch, the reviewer reported that 16 unauthenticated connections produced roughly 3 MB of memory growth over 90 seconds, compared with 3.2 GB prior to the fix. Other Bitcoin software projects have separately addressed vulnerabilities in recent weeks, including hardware-wallet maker BitBox, which patched two severe firmware flaws in August with no evidence of exploitation reported, and Core Lightning developers, who have warned node operators of confirmed issues while preparing fixes.