Bitcoin Core 32.1: the same -privatebroadcast IP-leak fix reaches the new major branch; 29.x and older versions reach end of support

The release announcement says a path has been fixed where a transaction sent through sendrawtransaction with -privatebroadcast=1 could go directly over IPv4/IPv6 when falling back from P2P v2 to v1, bypassing the enforced route through the Tor proxy. Additionally: build 32.0 was tagged but never fully released, and branches 29.x and older have been declared End of Life and will receive no further updates; the source promises disclosure in two weeks of medium- and high-severity vulnerabilities fixed in 30.0 (3 in total).

Actions to take

If your node runs 29.x or older, it will receive no further updates, so plan a move to a supported release; do not use build 32.0, as it was not released. Procedure: stop the node, wait for it to shut down completely (sometimes several minutes), then run the installer (Windows) or copy Bitcoin-Qt (macOS) or bin/ and libexec/ (Linux); when moving from an EOL version, migrating the data directory may take time. Those who already have these fixes available need no additional action.

Sources:

Incident history

27 OctBitcoin Core v31.1: fixed a path where -privatebroadcast mode could connect over clearnet
28 OctBitcoin Core 32.1: the same -privatebroadcast IP-leak fix reaches the new major branch; 29.x and older versions reach end of support