From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Wed, 28 Oct 2026 11:57:24 -0700 Received: from mail-oo1-f59.google.com ([209.85.161.59]) by mail.fairlystable.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.94.2) (envelope-from ) id 1xM8pw-0003ZX-IG for bitcoindev@gnusha.org; Wed, 28 Oct 2026 11:57:24 -0700 Received: by mail-oo1-f59.google.com with SMTP id 006d021491bc7-702e606a1fdsf835699eaf.2 for ; Wed, 28 Oct 2026 11:57:24 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1793213838; cv=pass; d=google.com; s=arc-20260327; b=BUAisTuBTI/yV6Q2g4PRUtIQLR+qmGgjPHkS2JGRYwwiCrF2YV/mhuTCZ8VfdNqhov GKAWBArt9TBnIg4JPMRI6ujURB29bmkBmePx7Sdcj40deKGLuuYjGCoh3HNNSBERGiGf tgdrnilHDou/gl41vcG8b5OnGd7aif7DX7Y+/PfIgQxTIIApRVrqcJiEvLBMhL2nwNYV ZH3untHtxqnd4CgGJdsyJLQxKdx6r5rB0PUnxy2jHK4C6qK8JVR56vTdsk9h0xkmJ+FQ o4uhcEN0mw8BTsv7BtMbuH3q/d192yAD8qHKIGpG1jmcM0SaZfbq7KnKBzO+PPN5i04C lyLw== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to:mime-version:feedback-id :message-id:subject:from:to:date:dkim-signature; bh=ORoXxoPvHWWysXeaMENmui/mOrdJtfhcBzzcfsZTgcE=; fh=OGdc2Qzz2YZ8mJKp3V/RRubjxb0JIfp6ynL7h3RSjVI=; b=oRi/Pp8BHlZlKMdlRX6B82GD8n0puxdC1PmkbXJ8u0g38QOFgipVKThAUffqrldij1 Dyp6S/SWc+yKSENaxDkgdrQn3dENGrRhadsitO0Y5nxIzlIv41BVh3L1TjBPQ1Poa8Ov VJ2Z8lP9lwH5d+NNWq+Xqw4U+cv5eycXFf642SUiFDgvPdmhb4JdnkBdCUUZFebIoRfr c+Xcs/PmLHexD/rYst2uorBbtZcoRI8yFTmUkWFPyk76YtLzacXEHfXl59CfkQpvos4Q gELU2Pyq1J56lE7CkvP6FtmqUEDSR7IIXwgMDsJbuZJ81c6fGnGultDHI2chViCOWOcF PB9Q==; darn=gnusha.org ARC-Authentication-Results: i=2; gmr-mx.google.com; dkim=pass header.i=@protonmail.com header.s=protonmail3 header.b=OU3lFyFZ; spf=pass (google.com: domain of darosior@protonmail.com designates 109.224.244.122 as permitted sender) smtp.mailfrom=darosior@protonmail.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=protonmail.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20260707; t=1793213838; x=1793818638; darn=gnusha.org; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:content-type :mime-version:feedback-id:message-id:subject:from:to:date:from:to:cc :subject:date:message-id:reply-to:content-type; bh=ORoXxoPvHWWysXeaMENmui/mOrdJtfhcBzzcfsZTgcE=; b=Kk7KauTlCTQkDhFcJOgm1/N2auUWz0GgB0FM0rt8Xi79coU+XBRcvJSMoCLxal8iMi T8Eo1s2puXmD4PVtcT4TtBYGlLNvk/fTnCt3NEQLsp2ZCuN8wguGkNZUwMJvipvBiglP a51/jGpzGZf9qOTGVWUm0FPh0BVWHsgk9m74o0jqyxcKV8P480lqUVFeBhmNkLEUDNkE P8HoNQXt/MdAllP1KCuqgS2pbJTA2tZOPGfM8BEmw93H1zBsLEdc5OO2CSZvgSWOHwcZ bL2sKPCv04lF4tGP5s4DbBatfUevKx6NwgXwywXezSI3nyjhbpycP17jItIte6buwcEM ag0g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793213838; x=1793818638; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:content-type :mime-version:feedback-id:message-id:subject:from:to:date :x-beenthere:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to:content-type; bh=ORoXxoPvHWWysXeaMENmui/mOrdJtfhcBzzcfsZTgcE=; b=smKOYvkSQqmjT86ZS3FSofZ3otX8q/KVnB9Wc8IPq/XZL9PeF7nenceYVrh0X5ov0H d3YNI01ZAnmhpoga5a1Kqgo4kHH87sne91nwdtxegWwJ1vACwWQZY5jvrCPvowqeRfvb C+7b5ivT0KnUUmjKoxXcPoHTas03ZkSSciIbWgzxWXfaA0wprbSo/8g0wF3nNwADePWf RhHc/aJ8Jtmxz25K9JwEHqw+KzU2zQ7VUpCsqjMfxNehqTK3msxKGUKT1Nj3dTKwZCf5 mZ86F9e37gPeRoCW5DXl4+nx9Z4nLWo2QKkJ/cB8u32d5SYuXXyKyn00jUasI2Xv1hae 23Tw== X-Forwarded-Encrypted: i=2; AKwUvByp5v7DKtUsGVNTRbWkUI9LU/91F0/MW/TayyxhCd4pfMhVv/jKK19Bj7sdPOCG7Q4u6+mh9Mkt+wOK@gnusha.org X-Gm-Message-State: AFq9FYLfZD/X5bHuiMFvRjumUUXDkqdvKfa6JwjCZ5xPqxEBrc9AzsrE v9OWQ2KYqUuKFhgK5C6b7F+GeysNDil/Iw+tKFz1511uaQM1yPJZxS13 X-Received: by 2002:a05:6820:1611:b0:706:5b0b:4e80 with SMTP id 006d021491bc7-713ee6719f7mr1837626eaf.14.1793213838127; Wed, 28 Oct 2026 11:57:18 -0700 (PDT) X-BeenThere: bitcoindev@googlegroups.com; h="ATskLdcbZrMRUhmiqE4b/QvXffNe3eRoDKBSmuqBVD2tWeHaAA==" Received: by 2002:a05:6870:1d19:b0:49e:cec:1483 with SMTP id 586e51a60fabf-4a8ba7fa70bls1210367fac.1.-pod-prod-04-us; Wed, 28 Oct 2026 11:57:11 -0700 (PDT) X-Received: by 2002:a05:6808:c2c6:b0:4f5:4ce8:7e92 with SMTP id 5614622812f47-563836912d2mr2566245b6e.48.1793213831833; Wed, 28 Oct 2026 11:57:11 -0700 (PDT) Received: by 2002:a05:620a:a7c1:10b0:93e:7ec5:16 with SMTP id af79cd13be357-943f6603f43ms85a; Wed, 28 Oct 2026 11:36:25 -0700 (PDT) X-Received: by 2002:a05:6214:6312:b0:91c:8576:b224 with SMTP id 6a1803df08f44-91c8576b4d1mr16434436d6.35.1793212584948; Wed, 28 Oct 2026 11:36:24 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1793212584; cv=none; d=google.com; s=arc-20260327; b=ZS/+XzjKKgaMjh7gsGPpJ45mRm0n1QJon6ERkg30ULWSu1MYIg5EEwawfjRjusUY9n APaR7AGEbvZxYDB0NYIJWVriZqTHNZKTFyD8ykFfY4hMRzGduuDJCgjx4l2DC5Dvch+m LjO6/Sn1wc1l/q4girWfbPyKYloWZDBMxOHqGqW/ZfVmFo9R7BNcbZhgv8Q+y9MlAbGL 4BxjKYSKooEq7svhjc6fbVjPJzwmOW09utzpp922S5FCNxaZnHiZbwL11snlRkLBo5WM LYbS5n1Zi3fJ+Ed/YeBWUbuMwF4sBcAmjrZtQhYwSxsDjvvXFepYxqmtPzwjg6tC1PvM ZABg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:mime-version:feedback-id:message-id :subject:from:to:date:dkim-signature; bh=nNDmU7m0OD7iBXB2gSMvUKXaKWeXEgaCM7PdiN8nkiM=; fh=DMP0F9ULS1guKiqimntQRCN8ZraraesEgQuVcn7F0Z0=; b=eLvW6CmMurzyJnqh+QK0eEqgywQ+gv9W2ad0bMMi7dXeaOTEP3y3eeiPCzLn4nvekz b7FkUPs/MZ/r2A29rYQnirKXpMyGtCn4vE1G3zH9xceCj8KRSBcLi9CY06Uroa8eKp5f zU/ZdciFHi82s1ca2VdOzltQxQoSCTMZhlGuKYBdqenZ/w5wcm81pd+VKatdcqzkwxiM 5EGSs5eh8iQ+JqxtjfWaKJuSUjsuyPfeDbq5zinZri/oFoxwnI0xhjn1HKaiYHr284jk zKEknm5n9STWgVJrwAQA2DF3Qt44O/llQWOSdPhri6XjA4hQHwwfaZLBXwpda77RQjI5 vaUw==; dara=google.com ARC-Authentication-Results: i=1; gmr-mx.google.com; dkim=pass header.i=@protonmail.com header.s=protonmail3 header.b=OU3lFyFZ; spf=pass (google.com: domain of darosior@protonmail.com designates 109.224.244.122 as permitted sender) smtp.mailfrom=darosior@protonmail.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=protonmail.com Received: from mail-244122.protonmail.ch (mail-244122.protonmail.ch. [109.224.244.122]) by gmr-mx.google.com with ESMTPS id 6a1803df08f44-91c47fdb504si3257026d6.7.2026.10.28.11.36.24 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 28 Oct 2026 11:36:24 -0700 (PDT) Received-SPF: pass (google.com: domain of darosior@protonmail.com designates 109.224.244.122 as permitted sender) client-ip=109.224.244.122; Date: Wed, 28 Oct 2026 18:36:19 +0000 To: Bitcoin Development Mailing List From: "'Antoine Poinsot' via Bitcoin Development Mailing List" Subject: [bitcoindev] 3 Bitcoin Core security advisories for easily discoverable vulnerabilities Message-ID: Feedback-ID: 7060259:user:proton X-Pm-Message-ID: c82ee6f28cac8d2f05818ea357623342348d3382 MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" X-Original-Sender: darosior@protonmail.com X-Original-Authentication-Results: gmr-mx.google.com; dkim=pass header.i=@protonmail.com header.s=protonmail3 header.b=OU3lFyFZ; spf=pass (google.com: domain of darosior@protonmail.com designates 109.224.244.122 as permitted sender) smtp.mailfrom=darosior@protonmail.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=protonmail.com X-Original-From: Antoine Poinsot Reply-To: Antoine Poinsot Precedence: list Mailing-list: list bitcoindev@googlegroups.com; contact bitcoindev+owners@googlegroups.com List-ID: X-Google-Group-Id: 786775582512 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-Spam-Score: -1.0 (-) Hi, We just published 4 new releases to patch 2 medium severity and 1 low severity security vulnerabilities. Fixed releases are available for all past major versions [^0]: - 32.1: https://bitcoincore.org/en/2026/10/27/release-32.1/ - 31.2: https://bitcoincore.org/en/2026/10/28/release-31.2/ - 30.4: https://bitcoincore.org/en/2026/10/28/release-30.4/ - 29.5: https://bitcoincore.org/en/2026/10/28/release-29.5/ The details for each vulnerability are available in the corresponding security advisory: - https://bitcoincore.org/en/2026/10/28/disclose-tcp-oom/ - https://bitcoincore.org/en/2026/10/28/disclose-fpausesend-oom/ - https://bitcoincore.org/en/2026/10/28/disclose-undo-overflow/ These advisories are following our accelerated process for easily discoverable vulnerabilities. The release of fixed versions happens to coincide with the release of our latest major version, 32.1 [^1]. The 3 vulnerabilities pre-announced along with our latest major release, 32.1, are unrelated to the easily discoverable vulnerabilities above. Their disclosure goes through our regular process, and we will share the details for those in 2 weeks. See https://bitcoincore.org/en/security-advisories/ for more information on our security policy disclosure, or to consult historical security advisories. Antoine Poinsot [^0]: Including 29, which was then immediately made EOL by the release of major version 32. [^1]: https://gnusha.org/pi/bitcoindev/c47ceea6-99de-41fe-a97c-928881963eccn@googlegroups.com/T/#u -- You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group. To unsubscribe from this group and stop receiving emails from it, send an email to bitcoindev+unsubscribe@googlegroups.com. To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/vf_yceciSS4HUGwYYk6tuj8ndp-JKV5q2OBS9HKVaSRkO1ggCKxLEy3mS6rkL7tG3XLpRFS1pme4Niz83LUJeQNJNH8lHuyo_8ynAj_qRY4%3D%40protonmail.com.