Key Points
- This week, Bitcoin Core disclosed three previously patched vulnerabilities, one of which could disrupt mining operations.
- The most severe flaw could prevent affected nodes from generating valid block templates after a blockchain reorganization.
- Although default installations are unaffected, thousands of nodes are at risk of a potential Tor configuration flaw.
The most significant vulnerability, identified as CVE-2025-62861, affects Bitcoin Core versions 28.0 to 28.2 and 29.0 to 29.1. Categorized as high severity, this flaw involves transaction processing during blockchain reorganizations and may prevent mining nodes from constructing valid block templates.
At its core are version 3 transactions, commonly known as TRUC transactions, which operate under dedicated mempool limits. During chain reorganizations, Bitcoin Core may erroneously evict transactions while keeping dependent transactions, resulting in inconsistencies within its transaction pool.
This is particularly troublesome for miners. Affected nodes may experience block template validation failures, effectively preventing them from generating new mining work until a restart. Mining devices might continue hashing outdated templates, possibly missing out on transaction fees and reducing operational efficiency.
Security researcher Niklas Goegge reported the flaw on September 26, 2025. Developer Greg Sanders subsequently introduced a fix, which was merged on October 2, to prevent problematic transaction eviction during reorganizations.
The fix appears in Bitcoin Core software versions 30.0, 29.2, and 28.3, and continues through October 2025. However, around 9% of accessible nodes were still running vulnerable versions around the disclosure date.
The second vulnerability, CVE-2025-62859, was rated as medium severity and involves maliciously crafted compact blocks. Attackers could exploit improper handling of modified transaction witnesses to repeatedly delay block downloads. Under certain network conditions—including compromised high-bandwidth peer connections—the disruption could continue indefinitely.
Researcher Eugene Siegel identified this weakness in April 2025. Gregory Sanders developed a fix that has reached Bitcoin Core versions 30.0 and 29.2.
Meanwhile, CVE-2025-62860 exposed a completely different issue involving inbound Tor connections and trusted peer privileges. When operators configured Bitcoin Core’s optional -whitelist setting to include their Tor daemon address, incoming connections could mistakenly inherit privileges meant only for trusted peers.
These exemptions weaken certain denial-of-service protections and privacy safeguards. Bitcoin Core stated that thousands of accessible mainnet nodes might be affected, although standard configurations remain secure.
The November 10 announcement follows Bitcoin Core’s established disclosure schedule. Developers withheld technical details until the last vulnerable major release line, 29.x, reaches end-of-life status on October 27, 2026. Unlike the three AI-assisted vulnerability disclosures published on October 28, these issues followed traditional embargo processes.
Importantly, none of these vulnerabilities resulted in any Bitcoin thefts, unauthorized coin creation, or consensus failures, and no exploitations have been reported. Exploiting the mining bug requires specific reorganization conditions, meaning its impact is limited to affected operators and not Bitcoin itself.
This distinction matters for Bitcoin miners and node administrators. Even if a vulnerability does not endanger funds, software maintenance remains critical. This incident illustrates how seemingly minor transaction processing flaws can cause practical operational issues without undermining the network’s foundational consensus.
