Bitcoin Core 32.0 has entered its final testing phase with the release of v32.0rc1 on September 14, marking the penultimate step before the stable release scheduled for October 10. The update introduces several significant improvements including modified fee estimation mechanisms, enhanced block validation performance, and critical security fixes. According to the official release schedule, the stable version will focus primarily on client software updates without changing Bitcoin's consensus rules, representing a major maintenance release for the Bitcoin Core software ecosystem.
The most significant change in Bitcoin Core 32.0 is the modification of the estimatesmartfee function, which determines transaction fees for confirmation within a specified number of blocks. The new version introduces mempool_policy analysis alongside the current block_policy estimator, allowing both algorithms to work together by default and returning the lower estimate. This dual approach can reduce recommended fees after network load decreases while maintaining the block_policy's conservative approach. Additionally, developers have added parallel prefetching of transaction output data (prevouts) during block verification, using eight threads by default with a maximum of 16, though this can be disabled with the -prevoutfetchthreads=0 parameter. The updated mechanism can reduce recommended fees after network load decreases but will not increase them beyond the block_policy result, with users able to explicitly choose one algorithm via the fee_rate_estimator parameter.
Bitcoin Core 32.0 addresses a walletnotify vulnerability discovered since version 24.0 that affected non-Windows systems using the %w placeholder with the -walletnotify parameter. The vulnerability allowed an authenticated RPC user with wallet creation rights to set a specially crafted name that could disrupt shell escaping and execute additional commands under the Bitcoin Core process. The issue arose because the ReplaceAll() function passed the escaped wallet name to std::regex_replace() as replacement text, but developers have modified the mechanism to treat the name literally rather than using ReplaceAll() function, ensuring the issue cannot be exploited through standard P2P connections or without proper authorization. The new HTTP server fixes a memory consumption vulnerability discovered during an audit of Kimi K3, preventing uncontrolled memory usage when processing multiple requests simultaneously. The most realistic exploitation scenario required an authenticated client, and the new HTTP server has not been used in previous stable versions, so this issue did not affect nodes on earlier official client versions.
Version 32.0 includes substantial improvements to disk space requirements for the transaction index txindex, reducing storage by more than half after a complete rebuild. Existing indexes will remain compatible but require recreation to achieve the savings. The update also speeds up block validation, especially when necessary data must be read from disk, with the effect being less significant when data is already in memory. This performance enhancement addresses common bottlenecks in Bitcoin Core operations, particularly for users with slower storage systems or limited disk space. The new HTTP server fixes a memory consumption vulnerability discovered during an audit of Kimi K3, preventing uncontrolled memory usage when processing multiple requests simultaneously.
The walletnotify vulnerability fix builds on previous security improvements, as Bitcoin Core v30 released in October 2025 increased the default data limit in OP_RETURN outputs from 80 to 100,000 bytes. The 32.0 branch includes additional security enhancements beyond the walletnotify fix, demonstrating the ongoing commitment to addressing potential vulnerabilities in the Bitcoin Core ecosystem. These updates represent systematic efforts to strengthen the software's security foundation while maintaining compatibility with existing Bitcoin infrastructure.
