Bitcoin Core developers have publicly disclosed three security vulnerabilities affecting earlier versions of the software, including a high-severity bug that could prevent certain mining nodes from producing valid block templates after a chain reorganization.
The disclosures, published on November 10, cover one high-severity and two medium-severity vulnerabilities. All three had already been patched in October 2025, meaning the announcement does not represent three newly discovered or currently unpatched threats. Instead, it provides technical details about weaknesses that developers had addressed more than a year earlier.
The vulnerabilities carry the identifiers CVE-2025-62859, CVE-2025-62860, and CVE-2025-62861. Their disclosure highlights three distinct areas of Bitcoin Core’s attack surface: transaction mempool management, compact block processing, and network permissions for incoming Tor connections.
The highest-severity issue, CVE-2025-62861, affected Bitcoin Core versions 28.0–28.2 and 29.0–29.1. Security researcher Niklas Goegge reported it on September 26, 2025.
The bug involved TRUC transactions, a transaction format with additional mempool restrictions designed to limit unconfirmed transaction chains. Bitcoin Core introduced a mechanism called “sibling eviction” in version 28.0 to enforce these restrictions and support replace-by-fee behavior.
The problem emerged during a chain reorganization, or reorg, when the network replaces part of its recent transaction history with a different valid chain. Transactions from disconnected blocks are returned to the mempool, where they should be restored without applying certain ordinary transaction-policy restrictions.
However, Bitcoin Core’s sibling-eviction logic continued operating during this process. It could remove a restored transaction while leaving its unconfirmed descendants in the mempool. Those remaining transactions then referenced outputs that were no longer available.
The resulting inconsistency prevented affected nodes from successfully assembling valid mining block templates. According to the advisory, a node that experienced the problematic reorganization could not produce blocks until it was restarted and its mempool was reloaded into a consistent state.
The issue was fixed through a change that prevented TRUC sibling eviction from running during reorganization-related transaction restoration.
The second vulnerability, CVE-2025-62859, was rated medium severity and concerned compact block processing.
A malicious peer could exploit a witness-malleation handling issue to delay a victim node’s block processing. Under certain conditions, the affected software would request a block again from the same peer and wait for a timeout of up to 10 minutes.
The attack could potentially be repeated indefinitely if the attacker controlled all three of the victim’s high-bandwidth peers or if the victim operated Bitcoin Core in -blocksonly mode. Researcher Eugene Siegel reported the issue on April 28, 2025.
The third vulnerability, CVE-2025-62860, involved Bitcoin Core’s optional configuration.
Under certain setups, incoming Tor connections could inherit trusted-peer permissions because the software evaluated the IP address of the local Tor proxy rather than properly distinguishing the incoming onion connection. Whitelisted peers bypass certain denial-of-service limits and privacy protections.
The issue was particularly relevant to installations where the Tor daemon and Bitcoin Core shared a machine or local network, and the configured whitelist range included the proxy’s address. Bitcoin Core’s advisory said that thousands of reachable mainnet nodes had been affected by configurations that granted these permissions to incoming Tor connections.
Nodes that did not use the non-default option were not affected.
Bitcoin Core’s security updates addressed all three vulnerabilities through releases 28.3, 29.2, and 30.0. Version 30.0 was released on October 10, 2025, while version 29.2 followed on October 14. Version 28.3, which included fixes for the affected 28.x branch, was released on October 17 for the mining issue and October 20 for the Tor issue.
The last vulnerable 29.x release reached end of life on October 27, 2026, shortly before the public disclosures.
For operators, the practical recommendation is to run a supported Bitcoin Core version containing the fixes. The published advisories identify Bitcoin Core 29.2 or later in the 29.x series, and version 30.0 or later, as patched releases. Operators still running older software should upgrade, paying particular attention to mining configurations and nodes using Tor with custom whitelist settings.
Ordinary Bitcoin holders using exchanges, hardware wallets, or light-wallet applications do not need to update Bitcoin Core themselves solely because of these disclosures.
The timing reflects a common security practice in open-source infrastructure: developers can release fixes before publishing detailed vulnerability descriptions, giving operators time to upgrade before the underlying weaknesses become widely understood.
The three advisories do not report confirmed exploitation in the wild, stolen funds, or a compromise of Bitcoin’s consensus rules. Nor do they indicate that the Bitcoin network itself stopped producing blocks. The documented effects concern specific vulnerable node configurations and software behavior.
Nevertheless, the disclosures are a reminder that Bitcoin’s security depends on more than its consensus protocol. Mempool behavior, peer-to-peer communication, and node configuration all contribute to the reliability and resilience of the infrastructure supporting the network. Keeping that infrastructure updated remains essential, even when vulnerabilities do not directly threaten user funds.