Bitcoin Core Breaks Silence on Three Patched Security Vulnerabilities
Bitcoin Core developers have disclosed three security vulnerabilities, including a high-severity flaw that could disrupt Bitcoin mining capabilities.
One of the issues, CVE-2025-62861, was rated as high-severity due to its potential effect on Bitcoin miners. The bug could create problems after a blockchain reorganization, causing an inconsistent state in the node's mempool where unconfirmed transactions are stored.
Mining vulnerability
The high-severity vulnerability impacted Bitcoin Core software versions 28.0-28.2 and 29.0-29.1. It was first reported on September 26, 2025, by security researcher Niklas Goegge. The issue could prevent miners from creating new blocks after a blockchain reorganizes.
Medium severity issues
Two additional medium-severity vulnerabilities were also disclosed. The first (CVE-2025-62859) could enable malicious network participants to slow down Bitcoin block processing through an exploit involving transaction witness data. This could make an affected node wait up to 10 minutes before processing a block. The vulnerability was discovered by Eugene Siegel in April 2025.
The second vulnerability (CVE-2025-62860) involved Bitcoin nodes operating on the anonymous Tor network. Thousands of reachable Bitcoin mainnet nodes had been granting permissions for incoming Tor connections, though the issue did not affect nodes without the optional whitelist configuration.
Resolution and disclosure
All three vulnerabilities have been fixed by Bitcoin Core developers in October 2025. The fixes were integrated into Bitcoin Core 30.0 (released October 10) and Bitcoin Core 29.2 (released October 14). The high-severity mining vulnerability was also patched in Bitcoin Core 28.3.
The delayed disclosure follows Bitcoin Core's security policy, which requires developers to wait at least two weeks after the end of life of the last affected software version before publishing details of medium- or high-severity vulnerabilities.
Related
