Bitcoin Core vulnerability: 3 Bugs Patched, One High-Severity

Editor’s take (Keshav Aggarwal): I see this as good news for Bitcoin holders: finding security gaps and patching them gives more confidence that people really care about the technology. Miners on older versions should update as soon as possible, and this disclosure certainly increases my trust.

A Bitcoin Core vulnerability rated high severity could leave affected nodes unable to build block templates — and, for miners, unable to produce new blocks — until the node was restarted, developers disclosed on Nov. 10. The flaw, tracked as CVE-2025-62861, produced a mempool inconsistency during chain reorganizations and affected Bitcoin Core versions 28.0 to 28.2 and 29.0 to 29.1, according to the project’s security advisory.

The Bitcoin Core vulnerability was reported on Sept. 26, 2025, by security researcher Niklas Goegge, with developer Greg Sanders submitting the fix, according to U.Today and BeInCrypto. Patched releases shipped in October 2025 — version 30.0 on Oct. 10, 29.2 on Oct. 14 and 28.3 for the older series — well over a year before the advisory text was published. Developers did not report any evidence that the flaws were exploited.

The batch also covered two medium-severity issues: a denial-of-service bug that could stall block processing and a Tor-related privacy flaw. None reached the “critical” tier Bitcoin Core reserves for bugs that threaten coin theft at the protocol level, unauthorized coin creation or a permanent network-wide chain split.

What the mempool bug actually did

The mechanism runs through TRUC transactions, the version 3 transaction type defined by BIP-431, which permits a transaction only one unconfirmed ancestor and one unconfirmed descendant. Those are relay policy rules rather than consensus rules, so a valid block can contain arrangements the mempool will reject.

Bitcoin Core 28.0 introduced “sibling eviction” logic: when a new transaction would give a TRUC parent a second unconfirmed child, the existing child is treated as a replacement candidate and — if the incoming transaction pays enough — evicted under replace-by-fee rules. Trouble arrived during a reorganization, when transactions from disconnected blocks are pushed back into the mempool with a bypass_limits flag so they are restored faithfully, without anti-spam limits or topology restrictions. The sibling-eviction branch was not gated on that flag, so TRUC enforcement kept running while the transactions were re-added.

A reorg could therefore restore an arrangement that was legal inside a block but violated TRUC’s mempool limits. The node evicted the wrong transaction, its mempool fell into an inconsistent state, and block template creation failed its validity check. The node could not build a candidate block until it was restarted, which forces a rebuild of the mempool from scratch. For a miner or pool operator, that is a halt to the work that earns block rewards.

Are you exposed? How to check your Bitcoin Core vulnerability status

The affected releases are 28.0, 28.1, 28.2, 29.0 and 29.1. The fixed releases are 28.3, 29.2 and 30.0 or later; the 30.x line is the current series. Operators can read the running version string from the daemon with bitcoind –version, or from the debug window of the graphical client, and compare it against that list.

Exposure is concentrated in mining nodes and pool operators, but any node on an affected build can hit the mempool inconsistency — the practical damage is the loss of block template construction, not a loss of funds. A restart clears the bad state temporarily; the durable fix is an upgrade.

The other two bugs: a DoS stall and a Tor permission leak

CVE-2025-62859, rated medium, let a peer stall a node’s block processing by announcing a compact block with a manipulated witness, a form of transaction malleation. Under some circumstances an affected node could wait up to 10 minutes before processing a block, and the attack could be repeated indefinitely against nodes running specific configurations, according to U.Today.

CVE-2025-62860, also medium, was a privacy and denial-of-service issue on the Tor network: inbound connections over Tor were wrongly granted “whitelist” permissions, lifting various denial-of-service and privacy protections. U.Today reported that thousands of reachable Bitcoin mainnet nodes had been granting permissions to incoming Tor connections. Nodes that do not use the optional whitelist configuration were not affected.

What the disclosure delay says about Core’s process

Bitcoin Core classifies vulnerabilities into four tiers, from low to critical, and this batch landed in the middle of that range. The timing followed the project’s stated policy: details are held until at least two weeks after the end of life of the last affected software version. That is a floor, not a ceiling, and the gap between the October 2025 fixes and the Nov. 10 advisories ran far beyond it.

The process itself is changing. Bitcoin Core recently rewrote its security policy to account for AI, adding a category for “easily discoverable” vulnerabilities that can be surfaced by a simple prompt; those are now patched and disclosed immediately rather than held under a long embargo, Decrypt reported. The concern is that large language models have lowered the bar for finding flaws, a worry underscored by a volunteer “Bitcoin Red Team” racing to find AI-discoverable bugs before attackers do. BeInCrypto noted that an earlier October batch of three bugs had been flagged by an AI-powered scanner called Project Loupe.

Market context: fear, but no software event

Bitcoin traded at $74,448 at 17:20 UTC, up 1.7% over 24 hours but down 7.59% over seven days and 10.9% over 30 days, according to CoinPaprika data. The asset sits 41.12% below its all-time high of $126,173, with total crypto market capitalization at $2.589 trillion and Bitcoin dominance at 57.69%.

Sentiment is defensive: the Crypto Fear & Greed Index read 29 (Fear) on Nov. 11, down from 32 the previous day. Nothing in the price data suggests the advisory moved the market, which is the right reaction — a patched, apparently unexploited bug in an optional relay path is a maintenance story, not a network event.

What to watch next

• Node version adoption. The share of reachable nodes on 30.x is the real exposure metric; miners still on 28.x or 29.0–29.1 carry restart risk through the next deep reorg.
• Pool notices. Whether large mining pools publish upgrade confirmations, or report having hit the template failure in production.
• Exploitation reports. None so far, and the bug needs a reorg plus TRUC traffic to trigger, but watch for incident write-ups.
• AI-driven disclosure cadence. If “easily discoverable” bugs get immediate advisories, expect shorter, more frequent notices — and more pressure on operators to track releases.

Frequently asked questions

What is CVE-2025-62861?

It is a high-severity Bitcoin Core bug in block template creation. During a chain reorganization, TRUC sibling-eviction logic could corrupt a node's mempool so that block template creation failed its validity check, leaving the node unable to build candidate blocks until it was restarted.

Which Bitcoin Core versions are affected?

Versions 28.0, 28.1, 28.2, 29.0 and 29.1 are affected. The flaw was fixed in Bitcoin Core 28.3, 29.2 and 30.0, all released in October 2025, and later releases are also unaffected.

Did the bug put coins at risk or affect Bitcoin's supply?

No. The advisories describe a mempool and relay-policy issue, not a consensus change, and developers reported no evidence the flaws were exploited. None of the three bugs reached Bitcoin Core's critical tier, which covers coin theft, unauthorized coin creation or a permanent chain split.

Sources: Decrypt, CryptoPotato, U.Today, BeInCrypto