Bitcoin Core Discloses Three Patched Flaws, Including a Mining Bug
Bitcoin Core disclosed three security flaws on Tuesday, all of them patched more than a year ago. The most serious, rated high severity, could leave a mining node unable to produce a valid block template after a reorg, the short-lived fork in which one branch of blocks replaces another. Operators had to restart the node to recover. Two medium-severity bugs came out the same day. One let a hostile peer stall block processing, and the other handed inbound Tor connections permissions they were never meant to have.
The mining bug
The high-severity issue is CVE-2025-62861. Versions 28.0 to 28.2 and 29.0 to 29.1 are affected, according to the advisory. The cause sits in TRUC, a set of mempool rules that restrict transactions with unconfirmed relatives, and its sibling-eviction logic kept firing on transactions that came back to the mempool after a reorg, the same class of event that halted ten chains on THORChain. Block template creation stopped as a result, and a miner on an affected build stayed stuck until the process was restarted. Niklas Goegge reported it on 26 September 2025, and the fix was merged six days later. Nothing in the advisory says the bug was used against anyone.
Two medium-severity bugs
CVE-2025-62859 let a malicious peer delay block processing by up to ten minutes through witness malleation in compact blocks, a trick that alters the witness data attached to a transaction without changing its identifier. The advisory said the delay could be repeated indefinitely against nodes run with the blocksonly setting, or where an attacker held all three of a node's high-bandwidth peer slots. Eugene Siegel reported it in April 2025.
CVE-2025-62860 is narrower. A node that whitelisted a range of IP addresses also granted those permissions to inbound Tor peers arriving through a local proxy inside the range. Bitcoin Core said thousands of reachable mainnet nodes were whitelisting incoming Tor connections. A node that never set the option was never exposed. Martin Zumsande and Antoine Poinsot reported it.
Why the disclosure waited a year
The project holds medium and high-severity details back until two weeks after the last affected release reaches end of life, which it puts at roughly a year after the fixing major version ships. The last vulnerable version went end of life on 27 October, and the advisories landed 14 days later. That schedule is the whole explanation for a gap that otherwise looks strange: bugs reported in April and September 2025, fixed in October 2025, named in November 2026. An operator on a current build learned nothing on Tuesday that needed acting on, including the mining firms that took in $1.215 billion of revenue in October.
Where the records differ
The fix dates do not line up across Bitcoin Core's own pages. Version 30.0 shipped on 10 October 2025 carrying all three fixes, and 29.2 followed on 14 October. For 28.3, the CVE-2025-62861 advisory and its blog post give 17 October 2025, while the CVE-2025-62860 advisory gives 20 October. They do not reconcile. The Block, covering the disclosures on Wednesday morning, listed 30.0 and 29.2 and left 28.3 out, so an operator on the 28.x line reading that account alone would not learn that a patched release exists for it.
Everything named in the advisories is past end of life now, and the project's October releases sit well beyond them: 32.1 on 27 October, then 29.5, 30.4 and 31.2 the next day. The open question is how many nodes still run the old builds. The thousands in the Tor advisory counts nodes using the whitelist option, which is a different population, and the project published no count for the second.
Read also: BTCPay Server Tells Operators to Rebuild as $1.63M Is Traced