Bitcoin Core CVE-2026-117349

Exploitation requires an attacker to establish a Bitcoin P2P connection to the target node and exercise the send-path/send-buffer behavior referenced by the vendor as the fPauseSend OOM; the condition is reachable without authentication or user interaction (PR:N/UI:N) against nodes running Bitcoin Core before 29.5, 30.4, 31.2 or 32.1. Exploitation is limited by the need for network reachability to the node's P2P port (most impactful against listening nodes that accept inbound peers) and by the impact ceiling itself - only availability is affected (A:L), yielding memory exhaustion/degradation rather than code execution or data exposure. The exact message sequence that triggers the OOM is not described in the available sources.

This is a medium-severity denial-of-service issue, not a high-priority emergency, and the signals are consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3) describes a remotely reachable, low-complexity, unauthenticated condition whose only impact is partial availability (A:L) - no confidentiality or integrity effect - matching CWE-400 (uncontrolled resource consumption) and the described out-of-memory behavior. The EPSS probability is very low (0.16%, 5th percentile), there is no CISA KEV listing (not actively exploited), and no exploit code is identified in the input, so exploitation pressure today is minimal. The vuln.today decision label is 'this_month', indicating a routine prioritized patch rather than act_now/emergency. Net: a genuine but moderate DoS against Bitcoin Core nodes that should be patched on a normal maintenance cycle; it is a low-real-risk issue relative to its network-reachable vector because the worst outcome is memory exhaustion / node degradation, not compromise.

A malicious or malfunctioning peer connects to a Bitcoin Core node over the P2P network and exercises the send-path behavior referenced in the vendor disclosure (fPauseSend / send-buffer handling), causing the node to accumulate memory until it is exhausted. The result is degraded availability or a crash of the targeted node; no authentication or user interaction is required (PR:N/UI:N), but no public exploit code is identified at time of analysis.