Bitcoin Core discloses three patched security bugs, including high-severity mining flaw

What happened

Bitcoin Core developers published three security advisories on Nov. 10 covering flaws that had been patched more than a year earlier, according to Unchained and U.Today. One bug was rated High severity and two were rated Medium. All three fixes shipped in Bitcoin Core 30.0 on Oct. 10, 2025, and in 29.2 four days later; U.Today also reported that the high-severity issue was patched in 28.3.

The High-rated flaw, tracked as CVE-2025-62861, sat in the mempool, the pool of unconfirmed transactions each node maintains. It involved TRUC (version 3) transactions, which are restricted to one unconfirmed parent and one unconfirmed child. Version 28.0 introduced a "sibling eviction" rule that drops an existing child transaction in favor of a better-paying replacement. That rule continued to trigger during a chain reorganization, when a node swaps recent blocks for a competing chain and returns their transactions to the mempool. It could remove a restored transaction while keeping the transactions that spend it, leaving the miner's block template failing validation. According to the advisory quoted by Unchained, the node then "cannot produce blocks until it is restarted." Versions 28.0 through 28.2 and 29.0 through 29.1 were affected, and Niklas Goegge reported the issue in September 2025.

The two Medium-rated bugs touched different parts of the software. CVE-2025-62860 affected only nodes using the optional -whitelist setting, which relaxes denial-of-service limits and privacy protections for trusted peers. Because inbound Tor connections carry the local Tor daemon's address, whitelisting a range that covered the daemon granted every Tor peer the same permissions. Vendors that bundle Bitcoin Core with Tor configured it that way, which the project said resulted in "thousands of reachable mainnet nodes whitelisting all incoming Tor connections." Martin Zumsande and Antoine Poinsot reported the bug, and Poinsot alerted Bitcoin Knots maintainer Luke Dashjr and several affected providers in September 2025.

The third bug, CVE-2025-62859, allowed a malicious peer to stall a node's block processing by abusing the software's handling of compact blocks, a bandwidth-saving method of relaying new blocks. In some configurations the stall could be repeated indefinitely, and U.Today reported that an affected node could wait up to 10 minutes before processing a block. Eugene Siegel reported it in April 2025.

Why it matters

The High-severity bug is notable because of where it lands: a node running the affected versions in the wrong circumstances may stop producing blocks until an operator intervenes manually. Reorganizations are routine on a distributed network, so the interaction between the sibling-eviction rule and restored mempool transactions created a failure path that did not require an attacker. The Tor issue is different in character, since it silently widened permissions for peers connecting over the anonymity network rather than crashing anything, and the project's own description indicates the exposure was widespread among nodes set up by third-party bundles. None of the advisories state whether any of the flaws were exploited before the fixes shipped, leaving operators to rely on the patch timeline alone.

What the data shows

Three CVEs were disclosed: CVE-2025-62861 rated High, alongside CVE-2025-62860 and CVE-2025-62859 rated Medium. Fixes landed in Bitcoin Core 30.0 on Oct. 10, 2025 and in 29.2 on Oct. 14, 2025. Affected versions for the High-rated bug were 28.0 to 28.2 and 29.0 to 29.1. Reporters were Niklas Goegge in September 2025, Martin Zumsande and Antoine Poinsot in September 2025, and Eugene Siegel in April 2025. U.Today placed Goegge's report on Sept. 26, 2025, and said the node stall could last up to 10 minutes.

Background

The timing follows Bitcoin Core's security policy, which generally calls for developers to wait at least two weeks after the end of life of the last affected software version before publishing details of medium- or high-severity flaws. The last vulnerable line, 29.x, reached end of life on Oct. 27, 2026, and the advisories appeared shortly afterward; by Unchained's count, 396 days separated the 30.0 release from disclosure. The three advisories are separate from another round of disclosure on Oct. 28, 2026, when Bitcoin Core published details of three AI-found bugs without its usual embargo. The release notes from that round said three more bugs fixed in 30.0 were due to be detailed two weeks later.

What is still unclear

The advisories do not indicate whether any of the three bugs were exploited in the wild before fixes were available, and no public exploitation data accompanies the disclosures. The reports also differ on the minimum release that addresses the High-rated flaw: Unchained describes 29.2 and 30.0 as the first releases fixing all three, while U.Today states that 28.3 also patched the mining issue.

What to watch

Node operators running older release lines should track whether their software predates the October 2025 fixes. The project has also signalled that further details are pending for three additional bugs fixed in 30.0, following its Oct. 28, 2026 disclosure of AI-found issues. Any indication of exploitation of CVE-2025-62861, CVE-2025-62860 or CVE-2025-62859 would be the next development to watch.

Questions readers ask