---
title: "Bitcoin Core fixes TCP urgent-data flaw affecting non-Linux nodes"
description: "Bitcoin Core released versions 29.5, 30.4, 31.2 and 32.1 fixing a Medium-severity bug in which a malicious peer could exhaust memory on Windows, macOS or BSD…"
language: en
canonical: "https://whycoinmoves.com/en/events/bitcoin-unbounded-memory-growth-through-tcp-ebb349a4ff0ddb"
published: 2026-10-28T18:14:25.000Z
updated: 2026-10-28T19:15:02.000Z
indexable: true
---

# Bitcoin Core fixes TCP urgent-data flaw affecting non-Linux nodes

Bitcoin Core released versions 29.5, 30.4, 31.2 and 32.1 fixing a Medium-severity bug in which a malicious peer could exhaust memory on Windows, macOS or BSD…

Attributed sources: [Bitcoin Core](<https://bitcoincore.org/en/2026/10/28/disclose-tcp-oom/>)

## Key facts

Bitcoin Core released versions 29.5, 30.4, 31.2 and 32.1 fixing a Medium-severity bug in which a malicious peer could exhaust memory on Windows, macOS or BSD nodes by sending TCP urgent data, letting a paused peer bypass backpressure. The project said the flaw was found by an automated LLM scan in Elias Rohrer's Project Loupe at Spiral and validated by Gregory Sanders.
Evidence strength: Official source, 1 publisher group(s) (Bitcoin Core).
After site detection, observed returns were 5 minutes: -0.05% (Oct 28, 2026, 18:14 → Oct 28, 2026, 18:19, UTC; Gate · USDT); 1 hour: +0.38% (Oct 28, 2026, 18:14 → Oct 28, 2026, 19:14, UTC; Gate · USDT)
In the preceding 30 days, the 99th percentile of absolute hourly returns was 1.01% (OKX · USDT; cutoff Oct 28, 2026, 18:14, UTC).

## Returns after site detection

| Window | Return | BTC | Difference from BTC | Actual sampled interval (UTC) | Source |
| --- | --- | --- | --- | --- | --- |
| 5 minutes | -0.05% | -0.05% | 0.00 pp | Oct 28, 2026, 18:14 → Oct 28, 2026, 18:19 | Gate · USDT |
| 1 hour | +0.38% | +0.38% | 0.00 pp | Oct 28, 2026, 18:14 → Oct 28, 2026, 19:14 | Gate · USDT |

## Historical hourly baseline

| Metric | Value |
| --- | --- |
| Coverage | 100.0% (720/720) |
| Median absolute hourly return | 0.14% |
| 99th percentile of absolute hourly returns | 1.01% |
| BTC beta | 1.00 |
| Source / cutoff (UTC) | OKX · USDT / Oct 28, 2026, 18:14 |

## Claims and open questions

- Bitcoin Core stated that on platforms other than Linux a malicious peer could crash a node by sending TCP urgent (out-of-band) data, and that fixes shipped in versions 29.5, 30.4, 31.2 and 32.1.
- Bitcoin Core said the issue is rated Medium severity and easily discoverable, and that Linux users are not affected because it only affects the select() socket code path.
- Bitcoin Core said the issue was discovered through an automated LLM scan as part of Elias Rohrer's Project Loupe at Spiral, and the finding was validated and surfaced to the team by Gregory Sanders.
- Which release channels or distributions beyond the listed Bitcoin Core versions carry the fix has not been spelled out by the project.
- What the malformed TCP urgent-data sequence looks like in practice, and whether an exploit has been observed in the wild, is not stated in the disclosure.

## Source evidence

- [Unbounded memory growth through TCP urgent data on non-Linux systems](<https://bitcoincore.org/en/2026/10/28/disclose-tcp-oom/>) — Bitcoin Core; published Oct 28, 2026, 04:00; received Oct 28, 2026, 18:14 (UTC).


## Recent BTC events and market reactions

- [Bitcoin Core discloses low-severity undo file overflow bug and releases fixes](<https://whycoinmoves.com/en/events/bitcoin-undo-file-overflow-under-extreme-f1ab709d188592>) — Published Oct 28, 2026, 04:00 (UTC) · Official source (1 publisher) · General news · 5m +0.07% / 1h +0.41%
- [2026 crypto hack losses reach $2.35 billion, report shared with Bitcoin Magazine says](<https://whycoinmoves.com/en/events/bitcoin-centralized-exchange-defi-losses-dominate-14712c83169b50>) — Published Oct 28, 2026, 17:43 (UTC) · Single source (1 publisher) · Security · 5m +0.14% / 1h +0.29%
- [Strategy shareholders approve daily dividends on four preferred stocks](<https://whycoinmoves.com/en/events/bitcoin-strategy-mstr-shareholders-approve-daily-5877d3d7a0495c>) — Published Oct 28, 2026, 15:32 (UTC) · Multiple publishers (2 publishers) · General news · 5m +0.05% / 1h -0.03%
- [Bitcoin Core fixes memory growth flaw affecting pre-BIP31 peers](<https://whycoinmoves.com/en/events/bitcoin-bitcoin-core-32-1-released-0649bceffba900>) — Published Oct 27, 2026, 04:00 (UTC) · Official source (1 publisher) · Project updates · 5m +0.03% / 1h -0.13%
- [Bitwise lifts 2036 bitcoin price target to about $1.6 million](<https://whycoinmoves.com/en/events/bitcoin-bitwise-raises-bitcoin-target-1-c2aa835fbc64ba>) — Published Oct 28, 2026, 15:07 (UTC) · Multiple publishers (2 publishers) · Market watch · 5m +0.04% / 1h -0.13%
- [Full coin archive](<https://whycoinmoves.com/en/coins/bitcoin>)

## Research for this archive

- [Altcoin beta to Bitcoin: BTC, ETH, SOL and DOGE hourly returns](<https://whycoinmoves.com/en/research/hourly-returns-and-bitcoin-beta.md>)
- [Will Bitcoin go back up? Every crash since 2011 and its recovery time](<https://whycoinmoves.com/en/research/bitcoin-crash-recovery-time.md>)
- [Perpetual funding rates and annualized yield: a 2025 comparison](<https://whycoinmoves.com/en/research/funding-rates-versus-investor-returns.md>)
- [Bitcoin halving and bull markets: evidence from four halvings](<https://whycoinmoves.com/en/research/bitcoin-halving-and-market-cycles.md>)

Evidence levels describe source coverage, not the probability that a report is true. Price moves and their timing cannot establish a cause; minute samples show an observed interval and alert thresholds are heuristics. Explanations are model-assisted, with citations and figures checked. Source titles stay in their original language; full articles are not republished. [Methods and limitations](<https://whycoinmoves.com/en/methodology>)