Bitcoin Core discloses urgent-data memory flaw affecting non-Linux nodes

Bitcoin Core has disclosed a medium-severity denial-of-service vulnerability affecting its select()-based socket-monitoring path on non-Linux systems.

The issue involves TCP urgent data. According to the disclosure, a malicious peer could use it to bypass per-peer read backpressure, allowing memory use to grow without bounds and potentially causing a connected node to crash.

The affected path is used on Windows, macOS and BSD systems. Bitcoin Core said Linux users using the poll() path are not affected by this issue.

Fixed versions are now available in Bitcoin Core 29.5, 30.4, 31.2 and 32.1. Operators of affected systems should review the release applicable to their deployment.

How the vulnerability works

Bitcoin Core’s disclosure describes a mismatch in how its socket-monitoring backends handle exception monitoring. On non-Linux platforms using select(), TCP urgent data could be received in a way that bypassed the software’s normal per-peer read backpressure.

That bypass could permit unbounded memory growth if exploited by a malicious peer. The stated consequence is a denial of service: affected nodes could potentially run out of memory and crash.

The disclosure specifically limits the issue to the select()-based path. Bitcoin Core users on Linux using the poll() path are not affected.

Fix merged and backported

The underlying change was merged through pull request #36665 on October 26, 2026. It aligns exception monitoring between the poll() and select() socket-monitoring backends.

Bitcoin Core backported the change to its maintained 29.x, 30.x, 31.x and 32.x release branches. The resulting fixed releases are 29.5, 30.4, 31.2 and 32.1.

The release sequence follows earlier maintenance work, including Bitcoin Core 30.3 released with bug fixes. The urgent-data issue is a separate security disclosure with fixes across several maintained versions.

What node operators should check

Operators should first identify the operating system and Bitcoin Core version used by their node. The disclosed risk applies to deployments on non-Linux systems that use the select()-based monitoring path.

For affected environments, upgrading to the applicable fixed release addresses the disclosed flaw. The available fixed versions are 29.5, 30.4, 31.2 and 32.1.

The report concerns node availability rather than Bitcoin transaction authorization or wallet-payment redirection. It nonetheless illustrates why node operators should track security releases and maintain supported software versions.

Continue reading: Bitcoin Core 30.3 released with bug fixes on BTCNews.

Continue reading: Electrum fixes vulnerability that could let malicious servers divert Bitcoin payments on BTCNews.

Sources

• Bitcoin Core: Unbounded memory growth through TCP urgent data on non-Linux systems
• Bitcoin Core GitHub repository: sock: align exception monitoring between poll() and select() backends
• Bitcoin Core GitHub repository: Bitcoin Core releases

Our creator. Creates amazing NFT collections! Support the editor - Bitcoin_Man(TON) / Bitcoin Man Stickers(TON) / BM Numbers (TON) / Comics Book (TON) / Bitcoin_Man (ETH)

Pi Network (Guide)is a new digital currency developed by Stanford PhDs with over 55 million participants worldwide. To get your Pi, follow this link https://minepi.com/Tsybko and use my username (Tsybko) as the invite code.

Binance: Use this link to sign up and get $100 free and 10% off your first months Binance Futures fees (Terms and Conditions).

Bitget: Use this link Use the Rewards Center and win up to 5027 USDT!(Review)

Bybit: Use this link (all possible discounts on commissions and bonuses up to $30,030 included) If you register through the application, then at the time of registration simply enter in the reference: WB8XZ4 - (manual)