Bitcoin Core Vulnerabilities: Three Patched Bugs Disclosed - Bitcoin Foundation
Bitcoin Core developers disclosed three previously patched vulnerabilities on Nov. 10, 2026, including a high-severity mining flaw that could prevent affected miners from building new blocks until restart.
The vulnerabilities, identified as CVE-2025-62861 (high severity), CVE-2025-62859 (medium severity), and CVE-2025-62860 (medium severity), had already been fixed in software releases from October 2025. The newly published advisories provide detailed explanations of how these bugs could impact Bitcoin network operations.
The high-severity mining vulnerability (CVE-2025-62861) affected versions 28.0–28.2 and 29.0–29.1. After a blockchain reorganization, the software could leave its mempool in an inconsistent state, causing a failure in block-template creation and preventing miners from earning block rewards until the node was restarted.
Security researcher Niklas Goegge first reported the mining vulnerability on Sept. 26, 2025. Bitcoin Core developers subsequently integrated repairs into software releases and published the security advisories more than a year later, following their standard disclosure policy.
Transaction Handling Flaw
The mining vulnerability specifically involved version 3 transactions (TRUC) and restrictions under BIP-431. During a chain reorganization, Bitcoin Core restores disconnected transactions using bypass_limits=true. However, a bug in sibling eviction for TRUC transactions could remove restored transactions while leaving others with unavailable outputs, creating an inconsistent mempool state.
The process could remove a restored transaction while leaving other transactions that spent its now-unavailable outputs.
Processing and Tor Risks
CVE-2025-62859, a medium-severity vulnerability, could allow malicious peers to stall a node's block processing for up to 10 minutes using manipulated transaction witness data. In specific configurations, this attack could be repeated indefinitely, causing persistent operational delays.
CVE-2025-62860 wrongly granted whitelist permissions to inbound Tor connections, lifting denial-of-service and privacy protections. This issue affected operators using the optional whitelist configuration, with thousands of Bitcoin mainnet nodes reportedly granting such permissions incorrectly.
Policy Revision
Bitcoin Core developer Antoine Poinsot argued for faster patch releases for easily discoverable vulnerabilities, noting that large language models have lowered the effort required to identify certain software flaws. In an Oct. 22, 2026 message, he stated that an embargo 'achieves little but it delays the availability of a fixed release.'
For easily discoverable vulnerabilities, developers will backport fixes to every actively maintained major version and publish security advisories alongside the patched releases.
The revised policy introduces an 'easily discoverable' classification that can include vulnerabilities uncovered through simple AI prompts. For these issues, fixes will be expedited to maintained branches, while other vulnerabilities retain the standard severity-based disclosure timelines.
Related
