Bitcoin Core Software Update Aims for Speed and Security Patches

Bitcoin Core 32.0 has moved into release-candidate testing as developers work toward a planned final release on October 10, though that timeline may shift depending on test results. The update is primarily directed at node operators and software developers who run wallets or other services built on Bitcoin Core. One of the notable performance changes is an optimization to block verification: certain block checks can now read database information in parallel. That adjustment is intended to speed validation tasks on nodes without altering how quickly the Bitcoin network produces blocks. The release also changes the default transaction-exchange format used by some wallet commands. Four wallet commands will now default to a newer format for sharing partially signed transactions between wallets and signing devices; applications that need the previous format can still request it. Several security fixes are included. A patch prevents specially crafted wallet names from causing commands to run on a node’s host, a vulnerability that affected non-Windows systems when an authenticated user could create wallets and the walletnotify feature was set to execute commands. Another fix addresses excessive memory growth in Bitcoin Core’s new HTTP server, which handles requests from connected applications. Contributor Matthew Zipkin (posting as pinheadmz) reported the memory issue after auditing the HTTP server with the Kimi K3 AI model; an earlier correction had mitigated part of the problem but an out-of-memory scenario remained. During review, GitHub user jeanpablojp showed that unauthenticated requests could still increase memory usage: after Zipkin revised the patch, 16 unauthenticated connections produced about 3 MB of growth over 90 seconds versus roughly 3.2 GB before the fix. That patch was merged on September 5 for the 32.0 release. The Bitcoin Core update follows a period of other recent security work across the ecosystem: hardware-wallet maker BitBox fixed two serious firmware flaws in August, and developers of the payments software Core Lightning have warned node operators about confirmed vulnerabilities while preparing fixes.