Bitcoin Core developers have published security advisories describing three vulnerabilities that were fixed in October 2025, including a high‑severity flaw that could have interfered with mining after a blockchain reorganization. The disclosures, released on Nov. 10, follow the project’s policy of waiting at least two weeks after the end‑of‑life of the affected software versions before making details public.

BTC / USD
Source: CoinGecko. Prices are indicative.

Update, Nov 11, 23:08 UTC: Bitcoin.com reported that about 9% of reachable nodes were still running vulnerable versions at the time of disclosure, and that developer Greg Sanders merged the fix on Oct. 2, 2025, according to the outlet.

Update, Nov 11, 20:00 UTC: According to Decrypt, none of the three vulnerabilities were classified as “critical” by Bitcoin Core, and the project has recently revised its security policy to include a category for AI‑discoverable bugs, which will be patched and disclosed immediately.

Update, Nov 11, 16:38 UTC: According to Unchained, the disclosures arrived 396 days after the patches were shipped, and the write‑ups were published after the last vulnerable 29.x line reached end‑of‑life on Oct. 27, 2026. The advisory notes that it does not confirm any exploitation of the bugs.

High‑Severity Mining Vulnerability (CVE‑2025‑62861)

The most critical issue, catalogued as CVE‑2025‑62861, was reported by security researcher Niklas Goegge on Sept. 26, 2025. It could have caused an inconsistent mempool state after a chain reorganization, potentially preventing miners from creating new blocks. The bug affected Bitcoin Core releases 28.0‑28.2 and 29.0‑29.1 and was addressed in Bitcoin Core 28.3.

Medium‑Severity Flaws (CVE‑2025‑62859 and CVE‑2025‑62860)

The second vulnerability, CVE‑2025‑62859, was identified by Eugene Siegel in April 2025. It allowed a malicious peer to manipulate transaction witness data, potentially delaying block processing for up to ten minutes and enabling repeated attacks on nodes with certain configurations.

The third issue, CVE‑2025‑62860, related to nodes using the optional Tor whitelist. Thousands of reachable mainnet nodes inadvertently permitted inbound Tor connections, exposing them to potential abuse. Nodes without the whitelist configuration were not affected.

Patch Rollout and Disclosure Timeline

All three vulnerabilities were fixed in October 2025. The patches were incorporated into Bitcoin Core 30.0 (released Oct. 10), Bitcoin Core 29.2 (Oct. 14), and the earlier 28.3 update for the mining bug. The delayed public announcement aligns with Bitcoin Core’s security policy, which aims to give users time to upgrade before details become widely known.