Bitcoin Core disclosed three security vulnerabilities that were already patched, including a high-severity flaw that could stop affected mining nodes from creating valid block templates. The other two are medium severity. Fixes for all three shipped in October 2025.
Bitcoin Core publicly disclosed three security vulnerabilities on Tuesday, including a high-severity flaw that could prevent affected mining nodes from creating valid block templates. The earliest of the three was reported in April 2025, and the other two were reported in September last year.
High-severity bug hits miners after reorganizations
The high-severity issue, CVE-2025-62861, affected Bitcoin Core versions 28.0 to 28.2 and 29.0 to 29.1. Niklas Goegge reported it on Sept. 26, 2025.
The cause was that Bitcoin Core's TRUC "sibling eviction" rules were still being applied to transactions returning to the mempool after a chain reorganization. The bug could evict a transaction without removing its descendants, leaving the mempool inconsistent. As a result, miners affected by the issue had to restart their nodes before they could create valid block templates again.
Two medium-severity flaws target block processing and Tor peers
Eugene Siegel reported the medium-severity CVE-2025-62859 issue in April 2025. A malicious peer could exploit witness malleation in compact blocks to delay block processing by up to 10 minutes. According to the advisory, the attack could be repeated indefinitely against nodes running in "-blocksonly" mode, or where the attacker controlled all three high-bandwidth peers.
The third issue, CVE-2025-62860, let incoming Tor peers receive whitelist permissions if their proxy's IP address fell within a configured range. It affected nodes using the optional "-whitelist" setting when its IP range included the Tor proxy. Bitcoin Core said thousands of reachable mainnet nodes had been whitelisting incoming Tor connections, removing certain denial-of-service limits and privacy protections. Nodes without the non-default setting were not affected.
Fixes shipped in October 2025
Bitcoin Core 30.0 shipped with fixes for all three vulnerabilities on Oct. 10, 2025, followed by version 29.2 on Oct. 14, 2025. According to the advisories, the last vulnerable version went end of life on Oct. 27 this year.
Source: The Block
Trading involves risk.
Risk Disclaimer
