Bitcoin Core developers detailed three recently fixed vulnerabilities, one of which could have disrupted mining after a blockchain reorganization.
Bitcoin Core developers have published security advisories describing three vulnerabilities that were fixed in October 2025, including a high‑severity flaw that could have interfered with mining after a blockchain reorganization. The disclosures, released on Nov. 10, follow the project’s policy of waiting at least two weeks after the end‑of‑life of the affected software versions before making details public.
Update, Nov 11, 23:08 UTC: Bitcoin.com reported that about 9% of reachable nodes were still running vulnerable versions at the time of disclosure, and that developer Greg Sanders merged the fix on Oct. 2, 2025, according to the outlet.
Update, Nov 11, 20:00 UTC: According to Decrypt, none of the three vulnerabilities were classified as “critical” by Bitcoin Core, and the project has recently revised its security policy to include a category for AI‑discoverable bugs, which will be patched and disclosed immediately.
Update, Nov 11, 16:38 UTC: According to Unchained, the disclosures arrived 396 days after the patches were shipped, and the write‑ups were published after the last vulnerable 29.x line reached end‑of‑life on Oct. 27, 2026. The advisory notes that it does not confirm any exploitation of the bugs.
The most critical issue, catalogued as CVE‑2025‑62861, was reported by security researcher Niklas Goegge on Sept. 26, 2025. It could have caused an inconsistent mempool state after a chain reorganization, potentially preventing miners from creating new blocks. The bug affected Bitcoin Core releases 28.0‑28.2 and 29.0‑29.1 and was addressed in Bitcoin Core 28.3.
The second vulnerability, CVE‑2025‑62859, was identified by Eugene Siegel in April 2025. It allowed a malicious peer to manipulate transaction witness data, potentially delaying block processing for up to ten minutes and enabling repeated attacks on nodes with certain configurations.
The third issue, CVE‑2025‑62860, related to nodes using the optional Tor whitelist. Thousands of reachable mainnet nodes inadvertently permitted inbound Tor connections, exposing them to potential abuse. Nodes without the whitelist configuration were not affected.
All three vulnerabilities were fixed in October 2025. The patches were incorporated into Bitcoin Core 30.0 (released Oct. 10), Bitcoin Core 29.2 (Oct. 14), and the earlier 28.3 update for the mining bug. The delayed public announcement aligns with Bitcoin Core’s security policy, which aims to give users time to upgrade before details become widely known.
Users running legacy Bitcoin Core versions should upgrade to the latest release to mitigate the disclosed risks. Observers will monitor whether any active exploits emerge targeting nodes that have not yet applied the patches, and whether further security audits uncover additional issues in upcoming releases.
It is a high‑severity bug that could cause miners to lose block‑creation ability after a blockchain reorganization by corrupting the node’s mempool state.
The vulnerabilities impacted versions 28.0‑28.2 and 29.0‑29.1; patches are included in releases 28.3, 29.2 and 30.0.
Yes, operators should review their Tor whitelist settings and upgrade to the patched software to stop unintended inbound connections.
Discussion 0