Bitcoin Core developers have published details of three security flaws in the software that runs most of the Bitcoin network. The most serious one could have stopped a mining node from building new blocks after a chain reorganization.
The key detail is the timing. All three bugs were fixed in releases that shipped in October 2025, more than a year before the advisories went public on Nov. 10, 2026. None of them could be used to steal coins, create new bitcoin or split the chain.
A High-Severity Bug in Block Template Creation
The most serious flaw is tracked as CVE-2025-62861 and rated High severity. It affected Bitcoin Core versions 28.0 to 28.2 and 29.0 to 29.1.
It involved a mempool rule for version 3 transactions, known as TRUC. Under that rule, a TRUC transaction can have at most one unconfirmed parent and one unconfirmed child. When a new transaction would give a parent a second child, Bitcoin Core can evict the existing child if the newcomer pays enough in fees, a feature called sibling eviction.
The problem appeared during a chain reorganization. When blocks are disconnected, their transactions are put back into the mempool, and policy limits are supposed to be skipped. The sibling-eviction check still ran, so it could remove a restored transaction while leaving its child behind. That left the mempool holding transactions that spent outputs that no longer existed.
For a miner, the effect was direct. According to the advisory, an affected node could no longer create a valid block template until it was restarted, which reloads the mempool in a consistent state.
That would have meant lost mining time, not lost coins. As DCForecasts reported today, even small solo miners still win full blocks, and every miner depends on its node producing valid templates without interruption.
Two Medium-Severity Bugs Were Also Closed
The second advisory, CVE-2025-62859, covered a way for a malicious peer to stall a node’s block processing. It worked by announcing a compact block with a malleated witness. In the worst case, an attacker controlling a victim’s three high-bandwidth peers, or a node running in blocks-only mode, could repeat the stall indefinitely.
The third, CVE-2025-62860, affected privacy. Bitcoin Core could give inbound Tor connections the extra permissions meant for trusted peers when a node’s whitelist IP range matched its local Tor daemon. That lifted some denial-of-service limits and privacy protections for those connections.
Only nodes using the non-default whitelist setting were exposed. However, the advisory says some popular node packages set that option by default, which led to thousands of reachable mainnet nodes whitelisting all incoming Tor connections.
Most Reachable Nodes Already Run Patched Software
DCForecasts checked how many public nodes are still running versions affected by the high-severity bug. A Bitnodes snapshot taken at 17:01 UTC on Nov. 11 counted 20,111 reachable nodes, of which 18,048 identified as Bitcoin Core.
Of those, 14,187 nodes, or 78.6%, ran versions that include the fix. Another 2,011 ran versions older than 28.0, before sibling eviction existed, so this bug doesn’t apply to them. Only 1,850 nodes, about 10.3%, reported one of the affected versions.
That figure counts only reachable nodes, and it includes many machines that don’t mine at all. Any operator still on an affected release now has every reason to upgrade.
Why Bitcoin Core Waited a Year to Explain
The delay was deliberate. Under Bitcoin Core’s security policy, details of Medium and High severity bugs are published two weeks after the last affected release reaches end of life. That gives node operators about a year to upgrade before attackers can read exactly how a bug works.
The timelines show how quickly the fixes moved. The high-severity bug was reported on Sept. 26, 2025, and the fix was ready in Bitcoin Core 30.0 on Oct. 10, 14 days later. Fixes were also backported to the 29.x and 28.x branches, in versions 29.2 and 28.3.
The Tor whitelist bug was reported on Sept. 12, 2025, and fixed within a week in the code. Its reporters also notified the maintainer of the Bitcoin Knots client and several affected software providers before disclosure.
The block-stall bug took longer. It was reported in April 2025 and its fix shipped in version 30.0 and in 29.2 in October 2025.
Bitcoin Core’s policy also now has a fast track for bugs that are easy to find, including through a simple prompt to an AI model. Those are fixed and disclosed as soon as possible, without the usual waiting period.
Responsible Disclosure Keeps Bitcoin’s Base Layer Strong
All three flaws were found by developers and researchers who reported them privately to the Bitcoin Core security team before any public discussion. The advisories credit Niklas Goegge, Eugene Siegel, Martin Zumsande and Antoine Poinsot for the findings.
That process is one of Bitcoin’s quiet strengths. A volunteer-led, open-source project found, fixed and shipped patches for bugs touching mining and network privacy, then waited until most nodes had upgraded before explaining them.
For node operators, the advice is simple: run a maintained release, currently version 30 or later. For everyone else, this round of advisories shows that Bitcoin’s most important software keeps getting more robust, often long before the public hears about the problem.
DC Forecasts is a leader in many crypto news categories, striving for the highest journalistic standards and abiding by a strict set of editorial policies. If you are interested to offer your expertise or contribute to our news website, feel free to contact us at [email protected]
Discussion about this post