Newsletters: add 378 (2025-10-31) #2536

bitschmidty · 2025-10-27T17:50:59Z

news
- Bitcoin Core security advisories https://groups.google.com/g/bitcoindev/c/sBpCgS_yGws
stack exchange Q&A @bitschmidty
releases and notable code changes @Gustavojfe
lede @bitschmidty

TumaBitcoiner · 2025-10-27T20:15:24Z

I will take a look at this:

Bitcoin Core security advisories https://groups.google.com/g/bitcoindev/c/sBpCgS_yGws

bitschmidty

Trailing spaces build fixup for @TumaBitcoiner section

_posts/en/newsletters/2025-10-31-newsletter.md

TumaBitcoiner · 2025-10-30T10:31:58Z

_posts/en/newsletters/2025-10-31-newsletter.md

+
+- **Disclosure of four low severity vulnerabilities in Bitcoin Core:**
+    Antoine Poinsot  recently [posted][poinsot disc] to the Bitcoin Development Mailing List four Bitcoin Core security advisories for low severity vulnerabilities that were fixed in [Bitcoin Core 30.0][]. According to the [disclosure policy][disc pol], a low severity vulnerability is disclosed two weeks after the release of a major version containing the fix.
+    The four disclosed vulnerabilities are the following:


This was intended to be on a new line

TumaBitcoiner · 2025-10-30T10:32:16Z

_posts/en/newsletters/2025-10-31-newsletter.md

+    - [CVE-2025-46597][]: Highly unlikely remote crash on 32-bit systems. This bug may cause a node to crash when receiving a pathological block, in a rare edge case.
+
+    - [CVE-2025-46598][]: CPU DoS from unconfirmed transaction processing. This bug would cause resource exhaustion when processing an unconfirmed transaction.
+    Patches for the first three vulnerabilities have been included also in [Bitcoin Core 29.1][] and later minor releases.


This, too, should be on a new line.

@TumaBitcoiner can you update accordingly? Also, you can run make production to run the same sort of checks done here separate from make preview

Yes, I'll do it.
Is it possible to run a similar make production code from Docker? I'm having issues running the needed version of Ruby on the latest Debian.

_posts/en/newsletters/2025-10-31-newsletter.md

bitschmidty

Feedback for @TumaBitcoiner

bitschmidty · 2025-10-30T14:49:34Z

_posts/en/newsletters/2025-10-31-newsletter.md

+  weeks after the release of a major version containing the fix. The four
+  disclosed vulnerabilities are the following:
+
+  - [CVE-2025-54604][]: Disk filling from spoofed self connections. This bug


Im not strong on it, but we could follow the format of previous disclosures here in terms of bullets: https://bitcoinops.org/en/newsletters/2024/07/05/#disclosure-of-vulnerabilities-affecting-bitcoin-core-versions-before-0-21-0

Ok, I'll follow the format of previous newsletters!

_posts/en/newsletters/2025-10-31-newsletter.md

bitschmidty · 2025-10-30T14:51:32Z

_posts/en/newsletters/2025-10-31-newsletter.md

+  Antoine Poinsot recently [posted][poinsot disc] to the Bitcoin Development
+  Mailing List four Bitcoin Core security advisories for low severity
+  vulnerabilities that were fixed in [Bitcoin Core 30.0][]. According to the
+  [disclosure policy][disc pol], a low severity vulnerability is disclosed two


alternative link could be our coverage of that policy in the newsletter previously

bitschmidty

Feedback for @Gustavojfe

_posts/en/newsletters/2025-10-31-newsletter.md

LarryRuane · 2025-10-30T16:30:28Z

_posts/en/newsletters/2025-10-31-newsletter.md

+
+- **Disclosure of four low severity vulnerabilities in Bitcoin Core:**
+  Antoine Poinsot recently [posted][poinsot disc] to the Bitcoin Development
+  Mailing List four Bitcoin Core security advisories for low severity


Suggested change

Mailing List four Bitcoin Core security advisories for low severity

Mailing List four Bitcoin Core security advisories for low-severity

_posts/en/newsletters/2025-10-31-newsletter.md

kevkevinpal

Feedback for @TumaBitcoiner
Added some suggestions to give credit to whoever discovered the CVE's and merged the mitigations.

Feel free to add or leave as is

kevkevinpal · 2025-10-30T22:45:43Z

_posts/en/newsletters/2025-10-31-newsletter.md

+  weeks after the release of a major version containing the fix. The four
+  disclosed vulnerabilities are the following:
+
+  - [CVE-2025-54604][]: Disk filling from spoofed self connections. This bug


I think it makes sense to work in credit to whoever found the venuralbility if you can.

In this case, Niklas Goegge and both Eugene Siegel and Niklas Goegge worked on the mitigation

Maybe adding
The vulnerability was disclosed responsibly by Niklas Goegge in March 2022. Eugene Siegel and Niklas Goegge merged a mitigation in July 2025.

_posts/en/newsletters/2025-10-31-newsletter.md

kevkevinpal · 2025-10-30T22:54:29Z

_posts/en/newsletters/2025-10-31-newsletter.md

+  - [CVE-2025-46598][]: CPU DoS from unconfirmed transaction processing. This
+    bug would cause resource exhaustion when processing an unconfirmed
+    transaction. Patches for the first three vulnerabilities have been included
+    also in [Bitcoin Core 29.1][] and later minor releases.


Suggested change

also in [Bitcoin Core 29.1][] and later minor releases.

edge case. This bug was reported to the mailing list by Antoine Poinsot in April 2025. Pieter Wuille, Anthony Towns, and Antoine Poinsot implemented and merged the mitigation in August 2025.

bitschmidty · 2025-10-31T11:46:35Z

Force pushed some updates (I had begun making final changes already but took in changes recently made by @TumaBitcoiner). Added topic entries for the disclosures topic related to the news item.

bitschmidty · 2025-10-31T13:45:53Z

Noticed the notable code segment still had an errant PR, so removed it. Tweaked the topic entries and the lede.

Squashed.

Thank you @TumaBitcoiner and @Gustavojfe for authoring this week. Thanks to @LarryRuane for the review and @kevkevinpal for the review and suggestions in the news section. 🚀

Newsletters: add 378 (2025-10-31)

1ac36dc

bitschmidty self-assigned this Oct 27, 2025

bitschmidty commented Oct 30, 2025

View reviewed changes

TumaBitcoiner reviewed Oct 30, 2025

View reviewed changes

bitschmidty commented Oct 30, 2025

View reviewed changes

_posts/en/newsletters/2025-10-31-newsletter.md Outdated Show resolved Hide resolved

bitschmidty commented Oct 30, 2025

View reviewed changes

bitschmidty requested review from LarryRuane and murchandamus October 30, 2025 14:55

bitschmidty commented Oct 30, 2025

View reviewed changes

_posts/en/newsletters/2025-10-31-newsletter.md Outdated Show resolved Hide resolved

_posts/en/newsletters/2025-10-31-newsletter.md Outdated Show resolved Hide resolved

LarryRuane reviewed Oct 30, 2025

View reviewed changes

kevkevinpal reviewed Oct 30, 2025

View reviewed changes

bitschmidty force-pushed the 2025-10-31-newsletter branch from 21740e5 to e3ccc55 Compare October 31, 2025 11:45

bitschmidty force-pushed the 2025-10-31-newsletter branch from e3ccc55 to a722c9e Compare October 31, 2025 12:56

News378: news topic about disclosures

d241dc8

bitschmidty force-pushed the 2025-10-31-newsletter branch 4 times, most recently from 5ac8daf to a266742 Compare October 31, 2025 13:15

Gustavojfe and others added 3 commits October 31, 2025 08:27

News378: add merges and releases

113a299

News378: add stack exchange

2f8f9b4

News378: add topic entries

7d5f57c

bitschmidty force-pushed the 2025-10-31-newsletter branch from a266742 to 7d5f57c Compare October 31, 2025 13:27

bitschmidty merged commit b378c53 into bitcoinops:master Oct 31, 2025
1 of 2 checks passed

	Mailing List four Bitcoin Core security advisories for low severity
	Mailing List four Bitcoin Core security advisories for low-severity

	also in [Bitcoin Core 29.1][] and later minor releases.
	edge case. This bug was reported to the mailing list by Antoine Poinsot in April 2025. Pieter Wuille, Anthony Towns, and Antoine Poinsot implemented and merged the mitigation in August 2025.

Newsletters: add 378 (2025-10-31) #2536

Newsletters: add 378 (2025-10-31) #2536

Uh oh!

Conversation

bitschmidty commented Oct 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

TumaBitcoiner commented Oct 27, 2025

Uh oh!

bitschmidty left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

bitschmidty left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bitschmidty left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kevkevinpal left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bitschmidty commented Oct 31, 2025

Uh oh!

Uh oh!

bitschmidty commented Oct 31, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

bitschmidty commented Oct 27, 2025 •

edited

Loading

kevkevinpal left a comment •

edited

Loading