Releases, security notices and protocol work from the people who build Bitcoin software.
121 publications
Chainstate disk churn ends in Bitcoin Core 30.3, which also repairs a feebumper crash when the combined bump fee is unavailable (#34870) and a coin selection bug that computed an amount as a boolean (#34888). On the PSBT side, MuSig2 pubkeys now get validated during pubnonce and partial signature deserialization (#34219).
Bitcoin Core
An IP address leak in -privatebroadcast is closed in Bitcoin Core 31.1: some connections went out over clearnet instead of the enabled privacy network. The update also ends the chainstate rewrites behind excessive disk activity and rejects an empty pubkey list in MuSig2 key aggregation (#35316).
Bitcoin Core
A failed v2 handshake can expose the sender's IP address in Bitcoin Core 31.0: with -privatebroadcast set, the v1 retry skips the Tor proxy and connects directly to the peer. A malicious peer closing the handshake on purpose is the likely trigger. Until 31.1 ships, users can turn the feature off, set -v2transport=0 or send IPv4/IPv6 outbound through Tor.
Bitcoin Core
Bitcoin Core releases after 0.14.0 and before 29.0 could read freed memory while validating a crafted invalid block, crashing the node. CVE-2024-52911 is rated High, though an attacker must spend valid proof-of-work at the tip, and remote code execution is considered unlikely. Cory Fields reported it; 29.0 carries the fix.
Bitcoin Core
Cluster mempool replaces the old design in Bitcoin Core 31.0: ancestor and descendant limits give way to clusters capped at 64 transactions and 101 kB, and the CPFP carveout is gone. Default -dbcache rises to 1024 MiB on machines with at least 4096 MiB of RAM, and a new -privatebroadcast option sends sendrawtransaction broadcasts only over Tor or I2P.
Bitcoin Core
Two failures involving unnamed wallets get fixes in Bitcoin Core 28.4: legacy wallet migration (#34156) and createfromdump, whose failure path deleted the wallets directory (#34215). One DNS seed is also dropped from chainparams (#33723).
Bitcoin Core
Bitcoin Core 29.3 stops punishing peers that send consensus-invalid transactions (#33050). Validation gains a per-input sighash midstate cache for legacy, P2SH and segwit v0 scripts (#32473) and spots witness stripping without re-running Script checks (#33105), while the miner's addPackageTxs loses an unsigned integer overflow (#33475).
Bitcoin Core
A migration failure on unnamed legacy wallets is gone with Bitcoin Core 30.2 (#34156), and createfromdump no longer deletes the wallets directory when it fails on one (#34215). Pressing Ctrl-C no longer hangs during IPC wait calls (#33511).
Bitcoin Core
Under rare conditions a failed wallet.dat migration in Bitcoin Core 30.0 or 30.1 can delete every file in the wallet directory, putting funds at risk. Developers pulled those binaries and ask users not to migrate through the GUI or RPC until 30.2. The bug needs a default, unnamed wallet.dat that fails to migrate or load; other users are unaffected.
Bitcoin Core
Wallets on Bitcoin Core 30.1 stop considering unconfirmed TRUC coins that have ancestors (#33528). On the IPC side, options no longer require the -m argument (#33229), message logging costs less overhead (#33517) and running waitNext calls can be cancelled (#33676).
Bitcoin Core
Crafted non-standard transactions could tie up a Bitcoin Core node for a few seconds each without getting the sender disconnected, giving an attacker a way to delay block propagation. CVE-2025-46598, rated Low, was reported by Antoine Poinsot and mitigated in v30.0 by cutting worst-case validation time.
Bitcoin Core
Blocks over 1GB could overflow a size check on 32-bit Bitcoin Core nodes and crash them on the write to disk, but only as a compact block, and only against a victim running -maxmempool above 3GB with 1GB of transactions inside. Pieter Wuille found CVE-2025-46597, rated Low; capping -maxmempool on 32-bit systems closed it in 29.1 and 30.0.
Bitcoin Core
Repeatedly sending invalid blocks could run a Bitcoin Core node out of disk, since it logged every block failing basic sanity checks or forking off before the last checkpoint. Niklas Goegge and, independently, Eugene Siegel reported CVE-2025-54605, rated Low. Log rate-limiting in 29.1 and 30.0 fixed it.
Bitcoin Core
Default minimum feerates drop in Bitcoin Core 28.3: -blockmintxfee to 1 satoshi per kvB, -minrelaytxfee and -incrementalrelayfee to 100 satoshis per kvB. Wallet feerates stay put, and cheaper transactions may not propagate unless the new defaults spread across the network. Whitelist permissions also stop applying to onion inbound connections (#33395).
Bitcoin Core
FillBlock picks up two P2P fixes in Bitcoin Core 29.2: a witness mutation check (#32646) and an empty-header check before the call (#33296). TRUC checks are no longer enforced on reorg (#33504), and getblock and getblockheader stop returning the tip's target (#33446).
Bitcoin Core
OP_RETURN limits effectively disappear in Bitcoin Core 30.0: -datacarriersize defaults to 100,000 and one transaction may carry multiple data outputs, though -datacarriersize=83 restores the old cap. Default relay feerates fall to 0.1 satoshis per vB, legacy signature operations are capped at 2500 per standard transaction, and a new bitcoin command wraps the existing executables.
Bitcoin Core
Unconditional disk logging in Bitcoin Core 29.1 is rate limited to 1MiB per hour for each source location (#32604), and standard transactions may hold at most 2500 potentially executed legacy signature operations. Default relay feerates drop to 100 satoshis per kvB, while 32-bit builds cap -maxmempool at 500MB and -dbcache at 1GiB.
Bitcoin Core
Just over half of the changes in Bitcoin Core 28.2 are build work. Guix now notarizes the macOS app bundle and codesigns all macOS and Windows binaries (#31407), and depends gets compile fixes for libevent on NetBSD (#31500) and freetype under cmake (#32693).
Bitcoin Core
UPnP support is gone from Bitcoin Core 29.0; -natpmp now runs on a built-in PCP and NAT-PMP implementation instead of libnatpmp. Ephemeral dust arrives as a new policy, a fix for double-reserved block weight adds -blockreservedweight, and nodes ask every peer that announced an orphan for its missing parents. Versions 26.x and older reach Maintenance End.
Bitcoin Core
With -port set, Bitcoin Core 28.1 derives the default onion listening port as that port plus one rather than fixing it at 8334 on mainnet, so several local nodes can again run side by side without a startup collision. Manual HiddenServicePort lines in torrc may need changing. Secret data is also cleared in DecodeExtKey (#31166).
Bitcoin Core
