The Bitcoin Core project disclosed three bugs fixed in versions 29.5, 30.4, 31.2 and 32.1.

• TCP urgent data memory exhaustion (Medium): on non-Linux platforms, the select() socket backend kept reading after a peer was paused when it saw "exceptional" socket events, so a malicious peer sending TCP out-of-band data could queue unlimited data. The project says this lets a peer "trivially crash any Windows, macOS or BSD node it is connected to". Linux nodes, which use poll(), are not affected.
• Slow memory growth from paused pre-BIP31 peers (Medium): a peer that claims not to support nonced pings can avoid the 20-minute ping disconnect and let its send queue grow without limit.
• Undo file overflow (Low): a miner could push an undo file past 4 GiB so 32-bit positions wrap, corrupting undo data and stopping nodes on a later reorg (or immediately on Windows and 32-bit systems). Fixed for 64-bit systems; 32-bit systems and nodes storing blocks on FAT32 remain affected.

The TCP urgent-data bug was found by an automated LLM scan in Elias Rohrer's Project Loupe at Spiral and validated by Gregory Sanders. What to do: upgrade nodes, putting Windows and macOS nodes with open inbound connections first, and verify release signatures.