Bitcoin Core Reveals Three Flaws, Including a High-Severity Mining Bug

Bitcoin Core developers broke their silence on Nov. 10, publishing security advisories for three vulnerabilities in the software that runs a large share of the network's nodes. The headline issue, CVE-2025-62861, carries a high-severity rating because of what it could do to miners: stop them from creating new blocks. The flaw surfaces after a blockchain reorganization, when the network swaps previously accepted blocks for an alternative chain.

In that scenario, according to u.today, the node's mempool — the holding pen for unconfirmed transactions — can be thrown into an inconsistent state. Bitcoin Core versions 28.0 through 28.2 and 29.0 through 29.1 were affected. Security researcher Niklas Goegge first reported the bug on Sept. 26, 2025, and it was later patched in Bitcoin Core 28.3.

The second flaw, CVE-2025-62859, is rated medium severity and lets malicious network participants drag out block processing by tampering with transaction witness data. Under some conditions, an affected node can sit for as long as 10 minutes before it processes a block. Worse, the attack can be repeated indefinitely against a node running in specific configurations. Eugene Siegel found it in April 2025.

The third advisory, CVE-2025-62860, centers on nodes using the anonymous Tor network. Developers disclosed that thousands of reachable Bitcoin mainnet nodes had been granting permissions for incoming Tor connections. Nodes that skip the optional whitelist configuration were not affected.

None of this is fresh territory for the codebase. All three issues were fixed in October 2025, with patches landing in Bitcoin Core 30.0 on Oct. 10 and Bitcoin Core 29.2 on Oct. 14. The high-severity mining bug also got a fix in Bitcoin Core 28.3. The gap between patching and publishing fits Bitcoin Core's security policy, which typically holds back medium- and high-severity details for at least two weeks after the last affected software version reaches end of life.