Skip to content
SATWEI
Security notice

Private Broadcast May Reveal Sender IP Address in Bitcoin Core 31.0

Original on bitcoincore.org

Source
Bitcoin Corebitcoincore.org
Originally published
Original length
3 min read
Language
English

SATWEI summary

A failed v2 handshake can expose the sender's IP address in Bitcoin Core 31.0: with -privatebroadcast set, the v1 retry skips the Tor proxy and connects directly to the peer. A malicious peer closing the handshake on purpose is the likely trigger. Until 31.1 ships, users can turn the feature off, set -v2transport=0 or send IPv4/IPv6 outbound through Tor.

Tags

  • P2P
  • Tor

More from Bitcoin Core

Network2 min read

Slow unbounded memory growth on paused pre-BIP31 peers

By pretending not to support BIP 31 pings, a malicious peer could dodge the 20-minute disconnect and read slowly, swelling a node's send queue by up to 2MB per hour for each inbound peer and 5MB for each outbound one. CVE-2026-117349, rated Medium, is fixed by #36667 in Bitcoin Core 32.1, 31.2, 30.4 and 29.5; -blocksonly nodes were much less exposed.

Bitcoin Core

Development1 min read

Bitcoin Core 30.4 released

Bitcoin Core 30.4 stops treating BIP 9 bits 5 to 28 as soft fork signals, following BIP 323, so blocks that set them no longer trigger unknown-deployment warnings (#34779). Network changes include a timeout enforced on paused send peers (#36667), and flatfile positions now use 64-bit integers (#36669).

Bitcoin Core

Development2 min read

Unbounded memory growth through TCP urgent data on non-Linux systems

Windows, macOS and BSD nodes could be crashed by a connected peer sending TCP urgent data, which slipped past paused reads in the select() backend and queued memory without limit (CVE-2026-117350). Linux nodes use poll() and are not affected. Bitcoin Core 32.1, 31.2, 30.4 and 29.5 fix the Medium-severity bug, which an LLM scan under Project Loupe found.

Bitcoin Core