Bitcoin Core discloses three patched flaws including high-severity mining bug
Bitcoin Core has published details on three vulnerabilities patched over a year ago, led by a high-severity flaw that could halt a mining node's block creation until restart.
Bitcoin Core disclosed three previously patched security vulnerabilities on Nov. 10, following the end of life of its 29.x release line. The disclosures address denial-of-service and configuration issues rather than coin theft, and the advisories do not report any known exploitation in the wild.[5][3][1]
The most critical vulnerability, cataloged as CVE-2025-62861 and rated high severity, stemmed from a mempool inconsistency tied to version 3 TRUC transactions. Under Bitcoin Core versions 28.0 to 28.2 and 29.0 to 29.1, sibling eviction rules continued to execute during chain reorganizations when transactions were being re-added to the mempool. This could leave the mempool holding transactions that spent outputs that no longer existed, causing newly assembled block templates to fail validation and preventing the node from producing blocks until restarted. Niklas Goegge reported the issue in September 2025.[2][5][1]
The project also detailed two medium-severity flaws. CVE-2025-62860 affected nodes using the optional -whitelist parameter alongside bundled Tor software. Because incoming Tor traffic presented the local daemon's address, whitelisting that address accidentally gave anonymous inbound Tor peers trusted-peer permissions, bypassing denial-of-service and privacy limits across thousands of reachable nodes. Martin Zumsande and Antoine Poinsot reported the issue, prompting Poinsot to alert affected providers and Bitcoin Knots maintainer Luke Dashjr. The third vulnerability, CVE-2025-62859, was reported by Eugene Siegel and allowed a peer to stall a node's block processing by abusing compact block handling.[5][6][4][7]
Patches for all three bugs originally rolled out in Bitcoin Core 30.0 on Oct. 10, 2025, and in version 29.2 four days later. According to Unchained, 396 days elapsed between the software fix and the public disclosure.[5][2]
Key facts
- Bitcoin Core publicly disclosed details for three previously patched security bugs on Nov. 10, including one high-severity and two medium-severity flaws.
- The high-severity flaw, CVE-2025-62861, caused mempool inconsistency during chain reorganizations due to TRUC sibling eviction rules, halting block template production until the node restarted.
- CVE-2025-62861 affected Bitcoin Core versions 28.0 to 28.2 and 29.0 to 29.1, and was reported by Niklas Goegge in September 2025.
- Medium-severity bug CVE-2025-62860 allowed thousands of reachable nodes configured with -whitelist and bundled Tor setups to grant trusted-peer privileges to all incoming Tor connections.
- Medium-severity bug CVE-2025-62859 permitted a malicious peer to stall block processing by exploiting compact block handling.
- All three issues were resolved in Bitcoin Core 30.0 on Oct. 10, 2025, and in version 29.2 on Oct. 14, 2025, exactly 396 days before public disclosure.
- The disclosures followed the Oct. 27, 2026 end of life for the 29.x release line, and the advisories do not report any known exploitation of the bugs.
Sources · 7 sources
- CB
Crypto Banter@crypto_banterPost on X ·
🚨BITCOIN CORE DISCLOSES THREE PATCHED SECURITY FLAWS, INCLUDING HIGH-SEVERITY MINING BUG! Bitcoin Core published details of three vulnerabilities on November 10. One is high severity and two are medium. All were fixed in 29.2 and later 29.x releases, and in 30.0 and all later versions. The high-severity bug is a mempool inconsistency during reorg handling that can stop a miner from obtaining valid block templates until the node is restarted. The medium-severity issues involve incorrect whitelist privileges on inbound Tor connections and a check that can let a peer stall block processing.
Open source - TB
The Block@TheBlockCoPost on X ·
THE BLOCK: Bitcoin Core disclosed three previously patched security vulnerabilities, including a high-severity flaw that could prevent affected mining nodes from creating block templates. bitcoin:native The other two flaws could stall block processing and improperly grant trusted permissions to incoming Tor connections.
Open source - DE
DecryptArticle ·
A High-Severity Bug Could Have Stalled Bitcoin Mining—Bitcoin Core Has a Fix Three bugs—spanning denial-of-service and privacy issues rather than coin theft—have all been patched, with the most serious capable of halting a miner’s ability to build new blocks.
Open source - CR
CryptoSlateArticle ·
Thousands of Bitcoin nodes gave anonymous strangers a pass around security limits The November 10 disclosure traces misplaced peer privileges to bundled Tor-and-whitelist settings, with fixes available since October 2025. Read the full story on CryptoSlate Understand the crypto stories that matter and what to watch next. Get The Catalyst in your inbox
Open source - UN
UnchainedArticle ·
Bitcoin Core Discloses Bugs That Could Freeze Mining Nodes Bitcoin Core, the open-source software that runs Bitcoin nodes, disclosed three security bugs on Nov. 10, fixed more than a year earlier. One, CVE-2025-62861 , is rated High severity . The other two, CVE-2025-62860 and CVE-2025-62859 , are rated Medium. A CVE (Common Vulnerabilities and Exposures) number is a known flaw’s public ID. All three fixes shipped in Bitcoin Core 30.0 on Oct. 10, 2025, and in 29.2 four days later. By Unchained’s count, 396 days separated that release from disclosure. The write-ups came after the last vulnerable release line, 29.x , reached end of life on Oct. 27, 2026. The advisories do not say whether any bug was exploited. These are separate from three AI-found bugs Bitcoin Core disclosed without its usual embargo on Oct. 28; that round’s release notes said three more bugs fixed in 30.0 were due in two weeks. Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter . A Mining Node That Can’t Build Blocks The High-rated bug sat in the mempool, each node’s pool of unconfirmed transactions. It involved TRUC (version 3) transactions, which are limited to one unconfirmed parent and one unconfirmed child. Version 28.0 added a “sibling eviction” rule that drops an existing child for a better-paying one. That rule kept firing during a chain reorganization, when a node swaps recent blocks for a competing chain and returns their transactions to the mempool. It could remove a restored transaction while keeping those spending it. Per the advisory, the miner’s block template then fails validation, so the node “cannot produce blocks until it is restarted.” Versions 28.0 to 28.2 and 29.0 to 29.1 were affected. Niklas Goegge reported it in September 2025. Tor Peers Treated as Trusted The second bug only hit nodes using the optional -whitelist setting, which relaxes denial-of-service limits and privacy protections for trusted peers. Inbound Tor connections carry the local Tor daemon’s address, so whitelisting a range covering that daemon gave every Tor peer the same permissions. Vendors bundling Bitcoin Core with Tor set it that way, which the project said led to “thousands of reachable mainnet nodes whitelisting all incoming Tor connections.” Martin Zumsande and Antoine Poinsot reported it, and Poinsot alerted Bitcoin Knots maintainer Luke Dashjr and several affected providers in September 2025. The third bug let a malicious peer stall a node’s block processing by abusing its handling of compact blocks, a bandwidth-saving way of relaying new blocks. In some setups the stall could repeat indefinitely. Eugene Siegel reported it in April 2025. 29.2 and 30.0 are the first releases fixing all three, per the advisories’ timelines. Related Listen: When Could Quantum Computers or AI Break Bitcoin? An Updated Threat Window The post Bitcoin Core Discloses Bugs That Could Freeze Mining Nodes appeared first on Unchained .
Open source - LS
Laura Shin@laurashinPost on X ·
One of the three Bitcoin Core bugs disclosed this week gave inbound Tor connections trusted-peer permissions on nodes using the optional -whitelist setting. The project says thousands of reachable nodes were set up that way. https://t.co/rLzct0dsnP
Open source - CR
CryptoSlate@CryptoSlatePost on X ·
Old Bitcoin Core releases could wrongly trust Tor peers if a custom trust list included the Tor software's IP, @bitcoincoreorg says. Fixes shipped in October 2025. Operators should check settings and use a maintained release. via @akibablade https://t.co/rQi0Z0daxJ
Open source