Bitcoin Core discloses three patched security flaws, including high-severity mining bug

Bitcoin Core publicly disclosed three security vulnerabilities on Tuesday, including a high-severity flaw that could prevent affected mining nodes from creating valid block templates. 

The earliest of the three was reported in April 2025, with the other two reported in September last year. Bitcoin Core, the software used by many Bitcoin Bitcoin (BTC) nodes, issued fixes for each of them in October 2025.

The high-severity CVE-2025-62861 affected Bitcoin Core versions 28.0 to 28.2 and 29.0 to 29.1. Niklas Goegge reported it on Sept. 26, 2025. Bitcoin Core's TRUC "sibling eviction" rules were still being applied to transactions returning to the mempool after a chain reorganization. The bug could evict a transaction without removing its descendants, leaving the mempool inconsistent. Miners affected by the issue had to restart their nodes before they could create valid block templates again.

Eugene Siegel reported the medium-severity CVE-2025-62859 issue in April 2025. The vulnerability meant a malicious peer could exploit witness malleation in compact blocks to delay block processing by up to 10 minutes. The advisory said the attack could be repeated indefinitely against nodes running in "-blocksonly" mode, or where the attacker controlled all three high-bandwidth peers.

Tor whitelist vulnerability

The third issue, CVE-2025-62860, meant that incoming Tor peers could receive whitelist permissions if their proxy's IP address fell within a configured range. The medium-severity bug affected nodes configured with the optional "-whitelist" setting when its IP range included the Tor proxy. Bitcoin Core said "thousands" of reachable mainnet nodes had been whitelisting incoming Tor connections, removing certain denial-of-service limits and privacy protections. Nodes without the non-default whitelist setting were not affected.

Bitcoin Core 30.0 shipped with fixes for all three vulnerabilities on Oct. 10, 2025, followed by version 29.2 on Oct. 14, 2025. The last vulnerable Bitcoin Core version went end of life on Oct. 27 this year, according to the advisories.

In May, The Block reported on a separate high-severity memory safety vulnerability that developers had also patched before publicly disclosing it.