Monero Releases v0.18.5.3 with Extensive Bug Fixes and Security Hardening
The Monero project has rolled out version 0.18.5.3 of its software, a highly recommended update that addresses a large number of bugs across the daemon, wallet, ZMQ interface, and RPC components. The release is the result of 17 contributors who submitted 182 commits adding 4,162 new lines of code.
Daemon Improvements
The most significant changes target the Monero daemon. Key fixes include resolving P2P connection stalls, restoring transaction relay after a restart, and improving block relay handling. The team also refined duplicate handshake and timeout handling, grouped public IPv6 connection limits by /64 prefix, and flushed rejected block spans from disconnected peers.
Transaction serialization and validation received multiple patches, while the output offsets cache size is now limited to prevent unbounded memory growth. LMDB resizing and transaction handling were also improved across several commits. On the privacy front, the release disables get_transaction_pool in restricted mode, improves restricted RPC privacy filtering, restricts get_public_nodes to public zone peers, and rejects deep block submissions on restricted RPC endpoints.
Wallet and Security Updates
The wallet component received a broad set of fixes, including improved transaction validation for cold and multisig signing, corrected multisig output import and refresh handling, and faster refresh times for old accounts. A notable fix resolves an infinite loop when estimating transactions with many outputs.
Security hardening against malicious remote nodes was applied across multiple areas, and the wallet now preserves required SSL enforcement when allowing chained certificates. Log injection vulnerabilities from malformed JSON and HTTP headers have been patched, and Trezor bridge response sizes are validated before parsing to prevent potential exploits.
Additional Changes
The ZMQ interface can now recover from oversized requests and hides request contents from logs in restricted mode. RandomX was updated to version 1.2.3. The wallet RPC gained transaction weight reporting in describe_transfer, improved automatic refresh and shutdown handling, and now rejects the combination of --password with --wallet-dir.
Download and Verification
Binaries for Windows (32-bit and 64-bit), macOS (Intel and ARM), Linux (x86, x64, armv7, armv8, riscv64), Android (armv7 and armv8), and FreeBSD (64-bit) are available on the Monero downloads page. SHA256 hashes for all packages are published alongside a GPG-signed hash list at getmonero.org/downloads/hashes.txt. The project recommends that users verify both file hashes and the GPG signature to confirm authenticity.
The complete changelog and source code are available on GitHub under the v0.18.5.3 tag.
DeusOp - News
Publish Date: 2026-10-06-00:00