SMS
- Bitcoin Core has disclosed three security vulnerabilities, now patched, in the software that runs most nodes on the network—issues related to denial-of-service and privacy, not vulnerabilities that could lead to theft or forgery of coins.
- The most severe of these could corrupt the node's mempool during a chain reorganization, preventing miners from generating block templates until they restart.
- None of these three vulnerabilities meet Bitcoin Core's definition of "critical," and there have been no reports of exploitation.
Bitcoin core developers have disclosed three security vulnerabilities in the software that runs most nodes on the Bitcoin network, including a high-severity vulnerability that could disrupt mining—all issues have now been patched.
These vulnerabilities are outlined in a series of security advisories and relate to denial-of-service and privacy issues, rather than flaws that would allow attackers to steal coins or forge bitcoins.
Bitcoin Core is the reference software that runs the majority of nodes on the network. The software classifies vulnerabilities into four levels, from "low" to "critical," and all three of these fall into the middle categories.
The most severe issue, identified as CVE-2025-62861, involves block template creation—the process miners use to assemble new blocks.
According to the announcement, a chain reorganization may cause certain transactions to be incorrectly removed, disrupting the node's mempool—the waiting area for unconfirmed transactions—and preventing affected nodes from continuing to build block templates until they are restarted. For miners, this means their work of earning block rewards will be temporarily halted.
The second vulnerability, CVE-2025-62859, could allow peer nodes to slow down block processing by announcing a compact block with a tampered witness, representing a transaction malleability issue.
The third vulnerability, CVE-2025-62860, is a privacy and security issue: connections originating through the Tor anonymous network were incorrectly granted "whitelist" permissions, thereby weakening multiple denial-of-service and privacy protections on affected nodes.
None of these three vulnerabilities meet the "critical" level defined by Bitcoin Core for issues that threaten coin theft, unauthorized token creation, or permanent network-wide chain splits at the protocol level. Developers have also reported no evidence of these vulnerabilities being exploited.
These disclosures appear within the broader context of how Bitcoin defenders can keep pace with an evolving threat landscape.
Bitcoin Core recently updated its security policy to incorporate AI, introducing a new category for "easily discoverable" vulnerabilities that can be identified with a simple AI prompt; these vulnerabilities will now be patched and disclosed immediately rather than being kept hidden for extended periods.
This change reflects growing concerns that large language models have lowered the barrier to discovering vulnerabilities. The volunteer organization "Bitcoin Red Team" is also accelerating efforts to identify AI-detectable vulnerabilities across the ecosystem before attackers can exploit them.
These fixes were actually released earlier, with the announcement subsequently published according to Bitcoin Core’s disclosure schedule. Node operators are generally advised to run the latest software to maintain protection.
Daily Brief Newsletter
Start each day with the latest headlines, along with original features, podcasts, videos, and more.