Security hardening

This release consolidates fixes for security issues reported to Pearl. It strengthens handling of untrusted input, reduces exposure to remote crashes and resource exhaustion, and improves wallet safety and service defaults.

All node operators should upgrade as soon as possible. Miners and mining pools should upgrade first, because this release tightens a script validation rule (see Upgrade notes below).

Security improvements

• Network and RPC resilience: Bound request sizes and peer resource usage, improve authentication handling, and strengthen protections against stalled or misbehaving peers.
• Protocol and SPV validation: Tighten transaction, signature, and proof validation, and improve checkpoint and compact filter handling.
• Wallet safety: Validate transaction amounts and PSBT data, preserve the requested address type, and improve payment tracking after uncertain broadcast outcomes.
• Service hardening: Restrict diagnostic exposure, strengthen RPC transport requirements, redact credentials from logs, and safely render peer-supplied content.

Upgrade notes

• Script validation: OP_CHECKXMSSSIG now fails the script on a wrong-length public key or signature chunk instead of pushing false, so scripts that relied on that false result are no longer valid. Standard wallet spends are unaffected.
• Mempool: Chains of unconfirmed transactions are limited to 25 transactions, counting ancestors or descendants, and to 101,000 vbytes of ancestors. Transactions over these limits are rejected with too-long-mempool-chain.
• P2P: A peer is disconnected if more than 16 MiB or 1,000 messages are waiting to be sent to it, or if it reads less than 64 KiB in 30 seconds.
• JSON-RPC: Request bodies over 16 MB are rejected with HTTP 413. Websocket clients that authenticate in-band must send authenticate as their first command, within 10 seconds. Clients that send HTTP Basic Auth in the handshake are unaffected.
• pprof: --profile now listens on 127.0.0.1 only.
• Wallet RPC: StartConsensusRpc requires the node's certificate when the node address is not loopback.
• SPV sends: With no connected peers, a new send fails before signing with JSON-RPC error -9. A stored payment stays pending, with its inputs reserved, until it confirms, a verified block conflicts with it, or it is removed with removetransaction. To retry, use rebroadcasttransaction instead of creating a new send.
• PQ addresses: Requesting a post-quantum address from a locked or watch-only wallet now returns an error instead of a regular BIP-86 address.

Acknowledgments

Thank you to the following researchers for reporting issues through GitHub security advisories and helping improve Pearl’s security:

• @ace-network-oss
• @bodenkunde
• @C3Pool
• @danielmnr
• @Genvv77
• @Heidet
• @koyop
• @Laidbak83
• @loopghost
• @mhskrrr0
• @t-allfather
• @tschifra

We also thank Zellic for its SPV peer-counting report, and all anonymous reporters and community contributors for their contributions and support.

Full Changelog: v1.4.11...v1.5.0