Work has resumed on a specification and experimental Bitcoin Core support for TCP hole punching, which could help home nodes behind routers accept peer connections. A draft BIP also proposes shared spending-policy formats for co-signers used to emulate covenants.
Greg Sanders, Antoine Poinsot, Elias Rohrer, Oleksandr Kurbatov and Nishant Bansal join the Optech hosts for the #429 recap, which starts with Bitcoin Core #36665, #36667 and #36669 before moving to the updated security policy. Multiparty silent payments, a Core Lightning DoS disclosure and Eclair 0.14.6 come later; the transcript is still pending.
A channel announcement naming the same node at both ends could crash Core Lightning 25.02 through 26.04 on every restart, at a cost to the attacker of only onchain fees; the fix landed in 26.04.1. Newsletter #429 pairs that disclosure with Oleksandr Kurbatov's protocol for multiparty silent payment inputs and Bitcoin Core's faster point releases for easily discoverable bugs.
By pretending not to support BIP 31 pings, a malicious peer could dodge the 20-minute disconnect and read slowly, swelling a node's send queue by up to 2MB per hour for each inbound peer and 5MB for each outbound one. CVE-2026-117349, rated Medium, is fixed by #36667 in Bitcoin Core 32.1, 31.2, 30.4 and 29.5; -blocksonly nodes were much less exposed.
Socket exception monitoring now matches between poll() and select() in Bitcoin Core 29.5 (#36665), and paused send peers face an enforced timeout (#36667). Flatfile positions move to 64-bit integers (#36669), nodes assume v2transport for addresses from seeds, and one DNS seed is removed.
A miner could push a Bitcoin Core undo file past 4 GiB, wrapping its 32-bit positions and corrupting data, so nodes shut down if the right reorg follows; Windows and 32-bit systems fail at 2 GiB with no reorg. CVE-2026-117346 is rated Low and would take roughly a month of all network blocks. Versions 32.1, 31.2, 30.4 and 29.5 fix 64-bit systems; 32-bit nodes and FAT32 block storage stay affected.
Windows, macOS and BSD nodes could be crashed by a connected peer sending TCP urgent data, which slipped past paused reads in the select() backend and queued memory without limit (CVE-2026-117350). Linux nodes use poll() and are not affected. Bitcoin Core 32.1, 31.2, 30.4 and 29.5 fix the Medium-severity bug, which an LLM scan under Project Loupe found.
Bitcoin Core 30.4 stops treating BIP 9 bits 5 to 28 as soft fork signals, following BIP 323, so blocks that set them no longer trigger unknown-deployment warnings (#34779). Network changes include a timeout enforced on paused send peers (#36667), and flatfile positions now use 64-bit integers (#36669).
Private broadcast gets a ceiling in Bitcoin Core 31.2: the queue of transactions not yet echoed back from the network stops at 10,000 entries and refuses new submissions when full, leaving callers to clear it with abortprivatebroadcast (#35406). Version bits 5 to 28 no longer count as soft fork signals, per BIP 323.
Private broadcast in Bitcoin Core 32.1 no longer risks exposing the sender's IP address, a leak that could occur when a failed v2 connection retried over v1 directly instead of through Tor. The default -maxconnections rises from 125 to 200, and outgoing transaction relay is rate-limited through a global backlog rather than per peer.