The most serious flaw let a connected peer crash nodes running on Windows, macOS or BSD. It is the first disclosure under a policy of publishing easily found bugs as soon as fixes ship. Ethereum clients Teku and Besu separately patched a certificate flaw.
Bitcoin's developers have decided that when artificial intelligence can find a bug, keeping it secret no longer protects anyone. On Wednesday they put that policy into practice.
Bitcoin Core disclosed three vulnerabilities found by an AI-assisted code scan run by Spiral's Project Loupe and validated by a Core contributor. Two were rated medium severity and one low. No funds were at risk.
What the bugs did
The most serious let a connected peer send data that caused nodes running on Windows, macOS or BSD to exhaust their memory and crash. Linux nodes were not affected. A second medium-severity bug let memory use grow over time when certain peers were paused, by up to 2 megabytes an hour per inbound peer and 5 megabytes an hour per outbound peer. The third, rated low, involved an overflow in the files nodes use to undo blocks.
Fixes are included in current Bitcoin Core releases, including versions 30.4, 31.2 and 32.1, although the low-severity undo-file issue can still affect some 32-bit or FAT32 setups. Version 29.x and older are now end of life.
Why the timing changed
Bitcoin Core's 32.1 release notes, published on Tuesday, set out the approach: "any easily discoverable vulnerabilities fixed in this release will be disclosed as soon as fixed releases are available." Historically, the project has waited after fixes ship before publishing details, to give node operators time to upgrade.
The reasoning is that when automated tools can find the same flaws quickly, attackers can find them too, and a waiting period mainly benefits whoever finds the bug first. The project said it will disclose three more medium and high-severity vulnerabilities fixed in version 30.0 in two weeks, around Nov. 11.
Ethereum's separate patch
Ethereum validators faced a different kind of risk. Weak keys at eMudhra, an Indian certificate authority, could have let an attacker impersonate services that some validators connect to and redirect block rewards. The Teku and Besu clients shipped updates that remove four certificate roots. Teku said a default node on mainnet "is not affected and needs no action" and that "no exploitation has been reported."
Healthy process or new risk?
The reassuring reading: the bugs caused crashes, not theft, fixes for the two medium-severity bugs were available before disclosure, no exploitation was reported, and both ecosystems responded quickly.
The cautious reading: if AI tools are finding protocol bugs faster, exchanges, custodians and node operators will need to patch faster too, and the Ethereum flaw shows that crypto security can depend on ordinary internet infrastructure outside the protocol's control.
What to watch
The three further Bitcoin Core disclosures due around Nov. 11, upgrade rates among node operators, any reports of exploitation, and whether other projects adopt faster disclosure.