Bitcoin Core 32.0 has entered its final testing stage, bringing changes to transaction-fee estimation, block processing, wallet transaction formats and several security issues.
The first release candidate for Bitcoin Core 32.0 was tagged on Sept. 14, beginning the project’s final testing period ahead of the planned Oct. 10 release, according to the Bitcoin Core release schedule.
Bitcoin Core is the software that allows computers to operate Bitcoin nodes and independently verify transactions and blocks according to the network’s rules. The 32.0 update does not alter those underlying Bitcoin rules.
New Approach to Fee Estimation
One of the main changes involves how Bitcoin Core calculates recommended transaction fees.
The current estimator primarily relies on fees paid by transactions that were included in earlier blocks. Version 32 introduces another estimator that analyzes transactions still waiting in the mempool to be confirmed.
Bitcoin Core can compare the two estimates and recommend the lower figure when network conditions justify it. According to the draft release notes, this should allow fee estimates to adjust downward more rapidly after congestion eases, rather than continuing to reflect higher fees from previous blocks.
The update also improves block-validation performance. Nodes can retrieve transaction information from their databases through multiple processing threads while validating blocks. Eight threads will be used by default, helping reduce disk-related delays when a node is catching up with the blockchain.
Wallet Security Vulnerability Fixed
Bitcoin Core 32 also addresses a vulnerability that had been present since version 24.0 on systems other than Windows.
Under specific conditions, an authenticated user who had permission to create wallets could assign a specially crafted name to a wallet and potentially cause commands to execute on the computer running the node.
The exploit depended on the node operator having enabled walletnotify, which automatically executes a selected command whenever a wallet transaction takes place.
The new version treats wallet names strictly as text, preventing portions of a wallet name from being interpreted as executable commands.
Wallet and PSBT Changes
Four Bitcoin Core commands that generate partially signed Bitcoin transactions will use PSBT version 2 as their default format.
Partially signed transactions are commonly transferred between wallet applications and signing devices before a bitcoin transaction is finalized and broadcast.
Software can still request the older PSBT format, but applications that directly depend on the affected Core commands will need to support version 2.
New Web Server Faces Memory-Exhaustion Fix
Bitcoin Core 32 also replaces the software’s existing web server, which handles requests from external applications communicating with a node.
Testing of the replacement server, conducted with Moonshot AI’s Kimi K3 model, uncovered a memory-exhaustion issue. The server could continue accepting incoming data from a client while processing an earlier request. As a result, data could build up in memory faster than it was released, allowing memory consumption to continue rising until the node ran out of available resources.
The developer who reported the issue characterized it as a memory-exhaustion scenario. Because the new server had not yet been included in a stable Bitcoin Core release, the problem was identified before version 32 was deployed.
Further testing found that the issue also affected Bitcoin Core’s REST interface, which does not require authentication.
In one test, 16 unauthenticated REST connections increased a node’s memory consumption from 46 MB to approximately 3 GB in about one minute. During a 90-second test, memory usage reached 3.2 GB before the fix, compared with roughly 3 MB after the vulnerability was addressed.
Together, the changes make Bitcoin Core 32.0 a substantial software update focused on faster validation, more responsive fee estimates, wallet compatibility and fixes for security and resource-exhaustion issues before the planned October release.
