Bitcoin Core details three flaws fixed in 2025

What did Bitcoin Core disclose, and could the flaws still affect your node? On Nov. 10, the project published details of three vulnerabilities fixed in 2025: one high-severity bug that could stop affected mining nodes from creating block templates, and two medium-severity issues affecting block processing and Tor connections. The Bitcoin Core advisory for CVE-2025-62861 says the mining bug affected versions 28.0–28.2 and 29.0–29.1.

How could a chain reorganization stop block templates?

The bug lay in how Bitcoin Core handled version 3, or TRUC, transactions when a chain reorganization returned transactions from disconnected blocks to the mempool. TRUC’s sibling-eviction rule could still run during that re-addition, even though the operation was meant to bypass mempool limits and restore transactions faithfully. A transaction could be evicted while its descendants remained, leaving the mempool inconsistent.

Bitcoin Core says a node in that state could fail the validity check when assembling a block template, preventing it from producing blocks until restarted. Niklas Goegge reported the issue on Sept. 26, 2025; the fix shipped in versions 30.0, 29.2 and 28.3. The advisory classifies it as high severity.

What were the other two flaws, and who was exposed?

The first medium-severity issue, CVE-2025-62859, let a malicious peer stall block processing for up to 10 minutes by exploiting witness malleation in compact blocks. The stall could be repeated indefinitely if the attacker controlled all three of a node’s high-bandwidth peers, or if the node ran with -blocksonly. Eugene Siegel reported it on April 28, 2025.

CVE-2025-62860 could give inbound Tor connections whitelist permissions when a node’s configured -whitelist range included its Tor proxy’s IP address. That setting lifted some denial-of-service limits and privacy protections; Bitcoin Core said thousands of reachable mainnet nodes were affected, while nodes without the optional setting were not. Fixes shipped across versions 28.3, 29.2 and 30.0, and the project disclosed the flaws after the last vulnerable 29.x release reached end of life on Oct. 27, 2026. Check which version your node runs next: the fixed releases are 28.3, 29.2 and 30.0.

References

• Bitcoin Core advisory for CVE-2025-62861 — bitcoincore.org