Bitcoin Core discloses three fixed denial-of-service vulnerabilities
Three advisories described distinct resource-exhaustion and storage failures, separating public disclosure from the earlier availability of fixes.
Bitcoin Core published three vulnerability advisories on October 28, 2026. CVE-2026-117349 concerned slow, unbounded memory growth involving paused peers predating BIP31. CVE-2026-117350 concerned memory exhaustion through TCP urgent data on non-Linux systems. CVE-2026-117346 described undo-file overflow under extreme conditions.
The failures involved different parts of a node's operation. Peer handling and operating-system networking behavior can consume memory, while undo data supports reversing block effects during chain reorganizations. Disrupting those functions can impair a node's availability without enabling an attacker to create a valid signature for someone else's coins.
The disclosure date was not the date on which all three flaws first existed or were first fixed. The advisories described issues addressed in maintained software versions, allowing operators and researchers to understand their mechanisms and affected conditions.
The publication made the security record more explicit. It documented concrete ways an implementation could become unavailable while preserving the distinction between software resource failures, theft of private keys and a failure of Bitcoin's monetary rules.