Three newly patched bugs in Bitcoin Core can crash the nodes that keep the network running, and the project just quietly changed how it discloses vulnerabilities. Whether that puts your coins at risk depends entirely on one question about how…
This post may contain links from our sponsors and affiliates, and Flywheel Publishing may receive compensation for actions taken through them.
Bitcoin Core is a key program used to run the Bitcoin (CRYPTO: BTC) network. On October 28, it was announced that three bugs could crash a node, which is essentially a computer running the software. Fixes for all three of these Bitcoin Core bugs are available in four releases: versions 29.5, 30.4, 31.2, and 32.1.
The market’s reaction was muted, with Bitcoin trading at $80,626 down 0.5% in the past 24 hours. This calm response seems appropriate for anyone who doesn’t operate a node.
Two of the Three Bitcoin Core Bugs Can Exhaust a Node’s Memory
Two of the three bugs are classified as medium severity and relate to memory exhaustion. These bugs are identified as CVE-2026-117349 and CVE-2026-117350. They allow an attacker to send node data that can exhaust memory and cause the node to stop functioning. The second bug specifically affects nodes running operating systems other than Linux.
The third bug is low severity and involves an overflow in undo data, a record that helps the node roll back recent blocks if the blockchain needs to reorganize.
According to the disclosures, no attacks have been reported on live nodes. However, Bitcoin Core has not released details on how many nodes are still running the affected versions.
Who Needs to Update Bitcoin Core After the Bug Fixes?
A “full node” is a computer that runs Bitcoin Core and downloads every block, checking each one independently. Only those operating a full node need to install the updated versions.
Holders who keep their coins on exchanges, in hardware wallets, or in light wallets (apps that rely on external nodes) need to do nothing. While a crashed node may temporarily stop working, it doesn’t grant anyone access to private keys, so coins remain secure.
Exchanges and custodians that manage Bitcoin Core nodes will handle the updates for their clients. Therefore, hobbyists who run home nodes, along with businesses that run nodes for their customers, need to take action.
Do Faster Bug Disclosures Raise the Risk to Holders’ Coins?
Bitcoin Core shares bug information only after implementing fixes, ensuring attackers are informed only after users can protect themselves. On October 22, the project also revised its disclosure policy. Now, the project quickly addresses easily identifiable flaws in all maintained versions and publishes a security advisory at the same time.
Developer Antoine Poinsot suggested this change, saying AI tools can now quickly identify certain vulnerabilities, making it less effective to keep bugs secret and potentially prolonging the time users remain on vulnerable code. We may see more disclosures, and more disclosed issues typically indicate improved bug detection.
In the past, Bitcoin has encountered more severe flaws. For example, in September 2018, developers resolved a vulnerability that could have allowed users to create more Bitcoin than the protocol allows. Bugs that can crash nodes are relatively minor by comparison. Moreover, the network operates on multiple independent nodes using different versions and operating systems, making it unlikely that a single bug could compromise the entire system.
Should Bitcoin Holders Be Concerned About the Bitcoin Core Bugs?
In short, no, unless a holder runs a node. We view the fixes as routine maintenance for node operators and pose no risk to most users’ coins. Node operators need to update to version 29.5, 30.4, 31.2, or 32.1, depending on their current version.
Our perspective may change if Bitcoin Core publishes a follow-up advisory indicating that someone has exploited CVE-2026-117349 or CVE-2026-117350 against live nodes. Such reports are available on the project’s security advisories page. Until then, holders face no new risks related to this situation.
Contact [email protected] for any questions or corrections.