Bitcoin Core 32.0 release candidate patches wallet-naming and memory-exhaustion bugs

Bitcoin Core, the reference implementation most of the network's nodes run, has entered release-candidate testing for version 32.0, with developers aiming for an October 10 final release. According to Decrypt, the release candidate includes two notable security fixes alongside a batch of performance work.

The first addresses a flaw in how the software handles wallet names. On non-Windows systems with the walletnotify feature enabled, a maliciously crafted wallet name could be used to execute unintended commands. The second targets the software's new HTTP server, where contributor Matthew Zipkin identified a memory-exhaustion scenario reachable through both authenticated and unauthenticated connections. Per Decrypt's reporting, the fix cut memory growth from 3.2 GB down to roughly 3 MB over 90 seconds in a test of 16 unauthenticated connections.

Neither bug requires action from end users today — this is a node-software release candidate, not an exploit being used against wallets in the wild. The practical takeaway is for anyone running a Bitcoin Core node: when 32.0 ships, verify the release signature before upgrading rather than pulling a binary from an unverified mirror, as the project recommends for every release.

The update also brings performance changes unrelated to security, including parallelized database reads that speed up block verification without affecting Bitcoin's block production rate, plus a shift to a newer default transaction format for several wallet commands, with the older format still available on request.

— WalletRecover Team