Bitcoin Core 32.0 has entered release-candidate testing, with developers aiming for a final release on October 10. The update focuses on enhancing performance for node operators by enabling parallel database reads to speed up block checks, without altering the network's block production rate. Additionally, four wallet commands will default to a newer format for exchanging partially signed transactions, though legacy support remains available.
The release includes significant security patches addressing flaws in non-Windows systems where crafted wallet names could trigger unauthorized commands via the walletnotify feature. Another patch resolves excessive memory usage in the new HTTP server, a vulnerability identified by contributor Matthew Zipkin during an audit using the Kimi K3 AI model. While initial assessments limited risk to authenticated clients, further review revealed that unauthenticated requests could also cause memory growth when the REST interface was enabled. The revised patch reduced potential memory exhaustion from 3.2 GB to approximately 3 MB over 90 seconds across 16 connections.
The progression of Bitcoin Core 32.0 into release-candidate status highlights the ongoing tension between optimizing infrastructure performance and maintaining rigorous security standards. By introducing parallel processing for block verification, the software aims to reduce latency for node operators, which is essential for scaling institutional-grade services that rely on rapid transaction confirmation. However, the inclusion of specific fixes for wallet command injection and HTTP server memory exhaustion underscores that operational efficiency cannot come at the cost of vulnerability exposure, particularly as nodes become more interconnected through APIs.
From a Compliance and Operational Risk perspective, the use of AI models like Kimi K3 in vulnerability auditing represents a shift in how open-source projects manage security assurance. This methodical approach to identifying edge cases, such as the distinction between authenticated and unauthenticated memory risks, provides greater transparency for enterprises deploying Bitcoin infrastructure. Stakeholders should monitor the final release timeline closely, as any delays in these patches could impact the readiness of wallets and exchanges to adopt the new defaults, potentially leaving systems exposed to known vectors until the stable version is widely deployed.
