Bitcoin Core discloses TCP out-of-memory vulnerability

On platforms other than Linux, a malicious peer could cause a node to run out of memory by sending TCP urgent (out-of-band) data. A fix for this issue was released in Bitcoin Core versions 29.5, 30.4, 31.2 and 32.1.

This issue is considered Medium severity and easily discoverable.

Bitcoin Core uses a different backend (based on select()) to monitor socket events on platforms other than Linux (where it uses poll()). This issue only affects the select() code path. Bitcoin Core users on Linux are therefore not affected by this issue.

Bitcoin Core limits the amount of data it will queue for processing per peer, by temporarily pausing reads when the queue exceeds a certain size. The select() socket monitoring backend watched sockets for exceptional conditions regardless of whether reads were paused. In handling that event, a read on the socket would be triggered, which could queue up more data for processing for that peer, without limit.

That event can be triggered by sending TCP urgent data. This allows a paused peer to bypass the backpressure mechanism and queue an unbounded amount of data for processing. In practice, this means a malicious peer can trivially crash any Windows, macOS or BSD node it is connected to.

This issue was discovered through an automated LLM scan, as part of Elias Rohrer’s Project Loupe at Spiral. The Loupe finding was validated and surfaced to the Bitcoin Core team by Gregory Sanders.

CVE-2026-117350 - Unbounded memory growth through TCP urgent data on non-Linux systems was published on

October 28, 2026.