Bitcoin Core Discloses an Old Address-Advertisement Crash Vulnerability
Bitcoin Core developers publicly disclosed a vulnerability affecting older versions in which sustained malicious address advertisements could cause a node to crash under certain conditions.
On May 16, 2025, Bitcoin developers publicly documented a previously fixed denial-of-service vulnerability affecting older Bitcoin Core releases. The flaw involved malicious or excessive peer address advertisements that could trigger memory pressure and eventually crash a node under sufficiently sustained conditions.
The disclosure was retrospective: supported releases had already incorporated the fix before the details were made public. Under ordinary default conditions, exploiting the issue required an impractically large and sustained stream of malicious address data, so the vulnerability did not produce a known network-wide failure or theft event.
Its historical value lies in Bitcoin Core’s security-disclosure process rather than in the scale of damage. The episode illustrates how vulnerabilities can move through private identification, patching, release, and later public disclosure so that users have time to upgrade before technical details become broadly available. It also documents the continuing work required to harden the peer-to-peer network against resource-exhaustion attacks even when consensus rules and user funds are unaffected.