CVE-2026-117350 is a denial-of-service vulnerability in the network transport layer of Bitcoin Core, specifically affecting nodes running on Windows, macOS, and BSD operating systems, while Linux nodes are not affected by this vector. On non-Linux platforms, the software uses the system select() call to monitor active sockets. When incoming message queues reach defined memory thresholds, the daemon pauses reading standard incoming traffic. However, the select() event handler continues listening for exceptional socket alerts. By transmitting urgent TCP out-of-band packets, an unauthenticated remote peer can force the socket into an active reading state. Once that state is reached, subsequent inbound messages bypass queue capacity restrictions entirely, allowing unconstrained network traffic to accumulate in system memory until the host exhausts physical RAM and crashes. The attack requires only a standard peer-to-peer network connection and does not require local operating system access. The business impact is loss of availability for full nodes that validate transaction histories and consensus blocks, potentially interrupting dependent services, reducing network reliability, and increasing operational costs for operators that rely on continuous node uptime.
We recommend you to update Bitcoin Core to version 29.5, 30.4, 31.2, or 32.1.[/subscribe_to_unlock_form]
CVE-2026-117350 is a denial-of-service vulnerability in the network transport layer of Bitcoin Core, specifically affecting nodes running on Windows, macOS, and BSD operating systems, while Linux nodes are not affected by this vector. On non-Linux platforms, the software uses the system select() call to monitor active sockets. When incoming message queues reach defined memory thresholds, the daemon pauses reading standard incoming traffic. However, the select() event handler continues listening for exceptional socket alerts. By transmitting urgent TCP out-of-band packets, an unauthenticated remote peer can force the socket into an active reading state. Once that state is reached, subsequent inbound messages bypass queue capacity restrictions entirely, allowing unconstrained network traffic to accumulate in system memory until the host exhausts physical RAM and crashes. The attack requires only a standard peer-to-peer network connection and does not require local operating system access. The business impact is loss of availability for full nodes that validate transaction histories and consensus blocks, potentially interrupting dependent services, reducing network reliability, and increasing operational costs for operators that rely on continuous node uptime.
We recommend you to update Bitcoin Core to version 29.5, 30.4, 31.2, or 32.1.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]