A High-Severity Bug Could Have Stalled Bitcoin Mining—Bitcoin Core Has a Fix
Bitcoin Core disclosed three security vulnerabilities in its software, including one high-severity bug that could have disrupted mining operations, all of which have now been fixed.
The vulnerabilities, detailed in security advisories, span denial-of-service and privacy issues rather than anything enabling coin theft or forgery. The most serious flaw, tracked as CVE-2025-62861, could corrupt a node's mempool during a chain reorganization, halting a miner's ability to create block templates until restarted.
Mining Disruption
The high-severity bug specifically affects block template creation, the process miners rely on to assemble new blocks. According to the advisory, a chain reorganization could trigger an erroneous eviction of certain transactions, corrupting a node's mempool—its waiting room for unconfirmed transactions—so that an affected node could no longer build block templates until it was restarted.
For a miner, that means a halt to the very work that earns block rewards.
Other Vulnerabilities
A second flaw, CVE-2025-62859, could allow a peer to stall a node's block processing by announcing a compact block with a manipulated witness, a form of transaction malleation. The third issue, CVE-2025-62860, was a privacy and security problem where inbound connections over the Tor anonymity network were wrongly granted 'whitelist' permissions, lifting various denial-of-service and privacy protections.
Security Response
None of the three vulnerabilities reached Bitcoin Core's 'critical' tier, which is reserved for bugs that threaten coin theft at the protocol level, unauthorized coin creation, or permanent network-wide chain splits. The developers reported no evidence the flaws were exploited. The disclosures come amid broader concerns about keeping pace with a shifting threat landscape, particularly as AI has lowered the bar for discovering vulnerabilities.
Bitcoin Core recently rewrote its security policy to account for AI, adding a category for 'easily discoverable' vulnerabilities that can be surfaced through a simple AI prompt, which it now patches and discloses immediately rather than holding under a long embargo. The volunteer 'Bitcoin Red Team' has been racing to uncover such bugs before attackers can exploit them.
Related
