What the developer wrote
Authored by Erick Cestari
wire: Reduce MaxMessagePayload to 4MB
To align with Bitcoin Core, reduce the maximum message payload size from
32MB to 4MB.
What changed, and why it matters
This commit lowers the largest single network message btcd will accept from 32 MB down to 4 MB, matching the limit used by Bitcoin Core. The change is a hardening/configuration alignment, not a fix for a known active attack. It mainly reduces the memory and processing exposure from a peer sending an oversized protocol message, which could help mitigate denial-of-service or memory-pressure issues. There is no direct evidence in the commit that a specific vulnerability was being exploited.
Treat as routine hardening. Review whether other per-message limits (blocks, transactions, headers) are independently enforced and consistent with Bitcoin Core. Monitor upstream Bitcoin Core and btcd release notes for any follow-up security context. No urgent patching is indicated by this commit alone.
Security signals we found
Denial-of-service hardening: reducing max payload limits memory allocation per peer message
Protocol alignment with Bitcoin Core reference implementation
No explicit security advisory, CVE, or vulnerability description in commit or references
Single-constant change with no additional input validation or tests
Evidence from the diff
The patch changes the wire.MaxMessagePayload constant in wire/message.go from 32 MiB to 4 MiB. This constant caps the payload length of any P2P wire message read by btcd. By aligning with Bitcoin Core’s limit, the node rejects oversized messages earlier and limits the maximum buffer allocation per message. The commit message frames this as a compatibility/consensus-adjacent hardening measure, not as a security bug fix.
Changed components
btcd/wire/message.goP2P message parsing and deserializationMaxMessagePayload enforcementInspect captured patch +1 / −1
diff --git a/wire/message.go b/wire/message.go
index 39c1dd0..074ac41 100644
--- a/wire/message.go
+++ b/wire/message.go
@@ -24,7 +24,7 @@ const CommandSize = 12
// MaxMessagePayload is the maximum bytes a message can be regardless of other
// individual limits imposed by messages themselves.
-const MaxMessagePayload = (1024 * 1024 * 32) // 32MB
+const MaxMessagePayload = (1024 * 1024 * 4) // 4MB
// Commands used in bitcoin message headers which describe the type of message.
const (
Why this scored 37/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.