Bitcoin Core discloses three now-patched bugs, including a high-severity mining flaw

Bitcoin Core on Tuesday publicly disclosed three security vulnerabilities — one high-severity and two medium — that its developers had already fixed in October 2025, according to The Block's reading of the project's advisories. All three were reported privately months earlier and quietly patched before this week's disclosure, the standard practice for software securing a roughly $2 trillion network.

The headline bug, CVE-2025-62861, is rated high-severity and affected Bitcoin Core versions 28.0–28.2 and 29.0–29.1. Niklas Goegge reported it on Sept. 26, 2025. Per the advisory, Core's TRUC "sibling eviction" rules were still being applied to transactions re-entering the mempool after a chain reorganization, and could evict a transaction without removing its descendants — leaving the mempool inconsistent. The practical effect: affected mining nodes could fail to produce valid block templates and had to be restarted to recover. It's a liveness/availability problem, not a theft-of-funds or consensus-break issue.

The second, CVE-2025-62859 (medium), was reported by Eugene Siegel in April 2025 — the earliest of the three. The advisory says a malicious peer could use witness malleation in compact blocks to delay a node's block processing by up to 10 minutes, and could repeat the attack indefinitely against nodes running in "-blocksonly" mode or where the attacker controlled all three high-bandwidth peers.

The third, CVE-2025-62860 (medium), concerns Tor. On nodes using the optional, non-default "-whitelist" setting, incoming Tor connections could inadvertently receive whitelist permissions if the Tor proxy's IP fell within the configured range — stripping away certain denial-of-service limits and privacy protections. Bitcoin Core said "thousands" of reachable mainnet nodes had been whitelisting incoming Tor connections this way. Nodes without the whitelist setting were unaffected.

Fixes shipped in Bitcoin Core 30.0 on Oct. 10, 2025, and 29.2 on Oct. 14, 2025. The last vulnerable version reached end of life on Oct. 27, 2025, per the advisories.

Key facts

• Three flaws disclosed Nov. 11, 2026; all patched Oct. 2025 (The Block, citing Bitcoin Core advisories).
• CVE-2025-62861 (high): mining-template failure after reorg; affects 28.0–28.2, 29.0–29.1; reported Sept. 26, 2025.
• CVE-2025-62859 (medium): up to 10-minute block-processing delay via compact-block witness malleation; reported April 2025.
• CVE-2025-62860 (medium): Tor whitelist exposure; "thousands" of mainnet nodes affected; non-default "-whitelist" only.
• Fixed in 30.0 (Oct. 10) and 29.2 (Oct. 14); last vulnerable version EOL Oct. 27, 2025.

The real-world read

Disclosure after patching is working as intended here — not a fire. The gap between the April and September 2025 reports and this week's disclosure is the responsible-disclosure window closing, consistent with the separate memory-safety bug The Block reported in May. Two caveats worth stating plainly: the high-severity bug hits miners specifically, so anyone running node software to build blocks should confirm they're on 30.0 or 29.2, and the Tor flaw only bites operators who opted into "-whitelist." Note the chain of attribution — these figures, including the "thousands" of affected Tor nodes, come from Bitcoin Core's own advisories as relayed by The Block; no independent count has been published.

This is news coverage, not financial or security advice. Node operators should verify versions against the official advisories.

Sources

• The Block (Tier 2, reputable secondary), Nov. 11, 2026 — reported the disclosure and summarized all three CVEs, severities, reporters, versions, and patch dates; itself citing Bitcoin Core's official security advisories (the primary source). No marketing or sponsored content involved in the reporting.