Bitcoin Core security · 2024–2026

Fix First, Disclose Later: CVE-2024-52911

A dangerous bug could allow a specially crafted block to crash nodes. Developers prepared a quiet fix, released it, and disclosed the details after the last vulnerable branch reached end of life.

A data-lifetime bug

In Bitcoin Core versions from 0.14.0 up to 29.0, validation of a specially crafted invalid block could leave background threads accessing memory that had already been released.

An attacker would need to produce a block with sufficient proof of work. The possible result was a remote node crash, and the developers classified the vulnerability as High severity.

A private report

On November 2, 2024, Cory Fields of MIT DCI privately reported the bug and proposed a mitigation. Four days later, Pieter Wuille added a workaround to an already open code change without publicly revealing the vulnerability.

The fix was merged on December 3, 2024 and released in Bitcoin Core 29.0 on April 12, 2025.

Why disclosure waited

Immediate publication would have provided useful details to an attacker while many node operators still ran vulnerable releases. Full disclosure was therefore delayed.

The final vulnerable 28.x branch reached end of life on April 19, 2026. On May 5, Bitcoin Core published the description, severity, attribution, and remediation timeline.

This did not change Bitcoin’s rules

The flaw was in an implementation of block validation, not in Bitcoin’s issuance schedule or ownership rules. A widespread node crash could still have disrupted availability for operators.

The episode distinguishes protocol from software. Consensus rules can remain unchanged while a particular implementation contains a memory-management defect.

The process is the lesson

The lasting record is not only the bug. It is the sequence: responsible reporting, a quiet fix, a safe release, end of life for the vulnerable branch, and public disclosure.

Transparency here meant a verifiable account after practical risk had been reduced, not immediate publication of dangerous details.

Security transparency does not always mean revealing everything immediately; sometimes the network first needs time to install the fix.

This technical summary intentionally omits reproduction instructions. Users should run supported Bitcoin Core releases.

Unless stated otherwise, the text, conclusions, structure and editorial arrangement were created by the project editors. Facts, quotations and source materials remain attributable to their authors and rights holders.