TL;DR
- Security Disclosure: Bitcoin Core node software maintainers revealed three vulnerabilities that were reported during 2025 and later patched in October 2025.
- Mining Risk: A high-severity flaw created mempool inconsistencies by removing transactions without clearing related descendants.
- Network Impact: Two medium-severity issues involved block-processing delays and unintended whitelist permissions for some Tor connections.
Bitcoin Core publicly disclosed three previously patched security vulnerabilities, including a high-severity flaw that could prevent some mining nodes from creating valid block templates. The issues were originally reported during 2025, and fixes were released in October of that year. The protocol said the vulnerabilities varied in severity, but each carried potential operational consequences for node operators and miners.
High-Severity Bug Created Mempool Inconsistencies
The most serious issue, tracked as CVE-2025-62861, affected Bitcoin Core versions 28.0 through 28.2 and 29.0 through 29.1. The vulnerability was reported by Niklas Goegge on Sept. 26, 2025. According to Bitcoin Core, transaction handling rules continued to be applied after certain transactions returned to the mempool following a chain reorganization.
As a result, a transaction could be removed without also removing its descendants, creating an inconsistent mempool state. For miners, the consequences were significant. Affected nodes needed to be restarted before they could once again generate valid block templates, making the flaw particularly relevant for mining operations that rely on uninterrupted node performance.
Two Additional Medium-Severity Vulnerabilities
A second vulnerability reported against Bitcoin Core in April 2025 was identified as CVE-2025-62859. Researcher Eugene Siegel found that a malicious peer could exploit witness malleation in compact blocks to delay block processing by as much as 10 minutes. The advisory released by Bitcoin Core noted that the attack could be repeated indefinitely against nodes operating in “-blocksonly” mode or in situations where the attacker controlled all three high-bandwidth peers.
Tor Whitelisting Issue Also Addressed
The third bug disclosed by Bitcoin Core, CVE-2025-62860, involved nodes using the optional “-whitelist” setting. Under certain configurations, incoming Tor peers could receive whitelist permissions if the proxy’s IP address fell within an approved range. Bitcoin Core said thousands of reachable mainnet nodes had been whitelisting incoming Tor connections, reducing some denial-of-service protections and privacy safeguards.
Nodes that did not use the non-default whitelist setting were unaffected. Bitcoin Core 30.0 included fixes for all three vulnerabilities on Oct. 10, 2025, followed by version 29.2 on Oct. 14. The last vulnerable Bitcoin Core release reached end-of-life on Oct. 27, according to the advisories.