Bitcoin Core 32.0 has entered its final testing stage, with the upcoming release introducing improvements to transaction-fee estimation and block validation while addressing wallet and memory-related security issues.

Developers tagged the first release candidate on Sept. 14. The final version is currently scheduled for Oct. 10, according to the project’s release timetable.

Bitcoin Core is the software used by Bitcoin node operators to independently verify blocks and transactions against the network’s consensus rules. Version 32.0 does not change those underlying rules.

Fee Estimation Gets a Second Data Source

The new release changes how Bitcoin Core determines suggested transaction fees.

The existing system largely bases its estimates on transaction fees observed in previously confirmed blocks. Bitcoin Core 32 adds a separate estimator that examines transactions currently waiting for confirmation.

The software will compare both calculations and may use the lower estimate when conditions on the network allow. The draft release notes indicate that this should help fees adjust downward sooner after congestion fades, rather than remaining influenced by costly transactions from earlier blocks.

Block validation is also being streamlined. Nodes can now retrieve transaction information from their databases with multiple processing threads operating simultaneously. Bitcoin Core will use eight threads by default, which can reduce time spent waiting for disk-based data when a node is syncing with the blockchain.

Wallet Command Vulnerability Patched

Developers have also corrected a vulnerability dating back to Bitcoin Core 24.0 on non-Windows platforms.

An authenticated user with wallet-creation privileges could potentially exploit a specially formatted wallet name to execute commands on the machine hosting the node.

For the attack to work, the node operator needed to have enabled walletnotify, a feature that runs a user-defined command whenever a wallet transaction occurs.

Bitcoin Core 32 resolves the issue by treating wallet names strictly as text, preventing command-like content in a name from being interpreted as executable instructions.

PSBT v2 Set as Default

Four commands used by Bitcoin Core to create partially signed Bitcoin transactions will now default to PSBT version 2.

These partially signed transactions are often exchanged between wallet applications and signing hardware before the final transaction is authorized and sent.

Users and applications can still request the older PSBT format, but software that directly relies on the affected Core commands will need to support version 2.

Memory Issue Caught During Testing

Another significant change involves Bitcoin Core’s web server, which is being replaced in version 32.

An audit of the replacement server using Moonshot AI’s Kimi K3 model identified a potential memory-exhaustion problem. The server could continue receiving information from a client while an earlier request was still being processed. This allowed data to accumulate faster than it could be removed, potentially driving memory consumption high enough to exhaust the node’s resources.

The problem was discovered before the new server was included in a stable release. Developers described it as a memory-exhaustion scenario and subsequently implemented a fix.

Testing found that Bitcoin Core’s unauthenticated REST interface was also affected. In one test, 16 REST connections increased a node’s memory usage from 46 MB to approximately 3 GB in around one minute.

A separate 90-second test consumed 3.2 GB before the fix, compared with roughly 3 MB after the correction.

With these changes, Bitcoin Core 32 moves closer to its planned October release, combining performance improvements with wallet, networking and security fixes while leaving Bitcoin’s consensus rules unchanged.