Bitcoin Core 32.0, the open-source software that allows computers to independently verify Bitcoin payments, entered release-candidate testing on Monday, according to the project's schedule. Release candidates are pre-release versions published so testers can surface remaining issues before the final build. Developers are targeting October 10 to ship the finished version, though the outcome of testing could still shift that timeline.

The update mainly affects node operators and developers who use the software to run wallets and other services, rather than everyday users of wallet apps. Performance is a central focus: according to the draft release notes, the update can speed up block checks by reading database information in parallel, without changing how quickly Bitcoin produces blocks. Faster verification matters because a full node's core job is to check each new block against the network's rules—blocks arrive roughly every ten minutes—so trimming that work lightens the ongoing load of verifying payments without a trusted third party.

Four wallet commands will also default to a newer format for exchanging partially signed transactions between wallets and signing devices—a format that lets an unfinished transaction gather signatures across devices before it is complete—though applications can still request the older version if needed.

Security is the release's other priority. One fix prevents crafted wallet names from triggering commands on a node's computer. The flaw affected non-Windows systems in cases where an authenticated user could create wallets and the walletnotify feature was configured to run commands when wallet transactions occurred. The bug class draws close attention because it collapses the line between data and instructions: a wallet name, normally just a label, could interact with the walletnotify feature's command execution, and the patch severs that path.

A separate patch addresses excessive memory use in the project's new HTTP server, which handles requests from connected applications. Contributor Matthew Zipkin, who posts under the handle pinheadmz, described a "memory exhaustion scenario" in his patch proposal. His initial assessment limited the risk to authenticated clients.

Zipkin said he found the flaw while auditing Bitcoin Core's new HTTP server with Kimi K3, an AI model that has also been used by the Bitcoin Red Team to search for vulnerabilities in Bitcoin software. An earlier fix had addressed part of the problem, he explained, but a way to exhaust a computer's available memory—an "OOM," or out-of-memory, condition—remained.

During review of that same patch, GitHub user jeanpablojp found that requests submitted without credentials could also cause memory growth when the REST interface was enabled. After Zipkin revised the patch, the reviewer reported that 16 unauthenticated connections produced about 3 MB of memory growth over 90 seconds, compared with 3.2 GB before the change. The revised patch was merged into Bitcoin Core 32.0 on September 5 as part of ongoing work to improve the software's security. The unauthenticated case broadened the concern beyond the first assessment, since requests of that kind need no trusted, logged-in user.

The patch lands amid a broader stretch of vulnerability response across Bitcoin-related software. Hardware-wallet maker BitBox patched two severe firmware flaws in August, reporting no evidence of exploitation. Separately, the developers of Core Lightning, a payments software, warned node operators about confirmed vulnerabilities while preparing fixes. The release candidates between now and October 10 will indicate whether the target date holds, and the fixes take effect only where operators end up running the updated version.