Bitcoin Core developers have disclosed details about three previously fixed vulnerabilities. One of them could disrupt the operation of mining nodes after a blockchain reorganization, forcing them to restart the software to generate valid block templates.
The developers released fixes for all the issues in October 2025.
A critical bug could disrupt the operation of mining nodes
The most serious was the vulnerability CVE-2025-62861, which was reported on September 26, 2025, by Niklas Gögger. It affected Bitcoin Core versions 28.0-28.2 and 29.0-29.1.
The problem was related to the sibling eviction mechanism — the rules for evicting related transactions within the TRUC policy. After a blockchain reorganization, these rules continued to apply to transactions that returned to the mempool.
As a result, the node could delete the parent transaction but keep its child transactions. This led to a violation of mempool consistency and could prevent miners from creating valid block templates. To restore operation, affected nodes had to restart the node.
The second problem, CVE-2025-62859, had a medium severity level. Eugene Siegel reported on it in April 2025.
The vulnerability allowed a malicious network peer to manipulate witness data (witness malleation) in compact blocks, delaying their processing for up to 10 minutes. The attack could be repeated without limits against nodes running with the -blocksonly parameter, or if the attacker controlled all three of the node's high-speed peers.
The third vulnerability, CVE-2025-62860, concerned the handling of incoming connections via Tor. Under certain configurations, the proxy server's IP address could fall within the whitelist range (-whitelist), as a result of which Tor nodes connected through it received privileged access.
This could weaken protection against DDoS attacks and reduce the level of privacy. According to Bitcoin Core, this configuration affected thousands of available nodes on the main network (mainnet). At the same time, nodes without the corresponding non-standard whitelist setting were not vulnerable to this problem.
The fix was released back in 2025
All three vulnerabilities were fixed in Bitcoin Core updates. Version 30.0 was released on October 10, 2025, and version 29.2 on October 14. The last vulnerable version of the software reached end of life on October 27, 2025.
Recall that earlier, the Bitcoin Core team disclosed information about three vulnerabilities found using automated code scanning by a large language model (LLM).