✓ Verified by 3+ outlets BTC
Bitcoin Core discloses three already-patched bugs, the worst of which could stop a mining node from building blocks
Summary
Bitcoin Core developers publicly disclosed three security vulnerabilities, all of which were fixed in releases shipped in October 2025, The Block and Decrypt reported.
The most serious, rated high severity and tracked as CVE-2025-62861, could leave a node's mempool inconsistent after a chain reorganization, so an affected miner could not create valid block templates until it restarted its node, according to both outlets.
The other two, rated medium, could let a malicious peer delay block processing using manipulated compact blocks, and could give incoming Tor connections trusted 'whitelist' permissions on nodes using a non-default setting.
Decrypt said the flaws involve denial-of-service and privacy issues rather than coin theft or forgery, none reached Bitcoin Core's 'critical' tier, and developers reported no evidence they were exploited.
Updates
- Update, : Added CoinDesk's report, which leads with the Tor whitelisting flaw and says it was disclosed Tuesday after being fixed in October 2025.
Key facts
- The Block: CVE-2025-62861 affected Bitcoin Core versions 28.0 to 28.2 and 29.0 to 29.1 and was reported by Niklas Goegge on Sept. 26, 2025.
- The Block: the bug came from Bitcoin Core's TRUC 'sibling eviction' rules still being applied to transactions returning to the mempool after a reorg, which could evict a transaction without removing its descendants.
- The Block: CVE-2025-62859, reported by Eugene Siegel in April 2025, could delay block processing by up to 10 minutes, and the advisory said the attack could be repeated indefinitely against nodes in '-blocksonly' mode or where the attacker controlled all three high-bandwidth peers.
- The Block: for CVE-2025-62860, Bitcoin Core said 'thousands' of reachable mainnet nodes had been whitelisting incoming Tor connections, removing certain denial-of-service limits and privacy protections; nodes without the non-default '-whitelist' setting were not affected.
- The Block: Bitcoin Core 30.0 shipped fixes for all three on Oct. 10, 2025, followed by version 29.2 on Oct. 14, 2025, and the last vulnerable version reached end of life on Oct. 27 this year, according to the advisories.
- Decrypt: the disclosures follow Bitcoin Core's recent security-policy rewrite adding a category for 'easily discoverable' bugs that an AI prompt can surface, which it now patches and discloses immediately.
- The outlets differ slightly in framing: The Block called Bitcoin Core the software used by 'many' bitcoin nodes and dated the disclosure to Tuesday, while Decrypt said it runs 'most' of the network's nodes.
- CoinDesk, focusing on the Tor whitelisting bug that it said made thousands of nodes trust any stranger on Tor, reported the flaw was fixed in October 2025 and kept quiet until Tuesday, and came out alongside the high-severity bug that could stop a miner from producing blocks until restarted.
Related stories
- Bitcoin drops below $72,000 as spot ETFs bleed $1.44 billion in five days and BlackRock's IBIT loses $2 billion in nine
- Bitcoin treasury firm Nakamoto owes Kraken $165 million, more than its market value, as Q3 operating revenue turns negative
- Binance sets aside $6.34 billion to cover record hack as TRM and Chainalysis tie it to North Korea's TraderTraitor