Bitcoin Core developers disclosed a high-severity flaw that could prevent affected nodes from producing new blocks. Bitcoin Core released a security advisory identifying the vulnerability as CVE-2025-62861 on November 10. The vulnerable releases were versions 28.0 to 28.2 and 29.0 to 29.1. Developers had corrected the problem more than a year earlier, but nodes using older software may remain at risk.
The flaw corrupted the mempool during chain reorganizations because a rule known as sibling eviction malfunctioned. The problem involved TRUC transactions, which permit only one unconfirmed child transaction. Bitcoin Core introduced sibling eviction in version 28.0, allowing a second child transaction with higher fees to replace the first. However, sibling eviction did not work correctly when nodes restored transactions from disconnected blocks. A node could remove a restored transaction while retaining that transaction's descendants. The remaining transactions then spent funds that no longer existed.
Miners and mining pool operators using vulnerable releases faced the main risk. An inconsistent mempool caused block template creation to fail a validity check. A block template is the candidate block a node assembles for miners, so the failure prevented the mining node from producing blocks. A restart was the only remedy for an affected node because restarting forced the node to reconstruct the mempool from scratch.
Security researcher Niklas Goegge responsibly reported the vulnerability on September 26, 2025. Developer Greg Sanders submitted a correction soon afterward. Bitcoin Core released patched versions 30.0, 29.2 and 28.3 in October 2025. Bitcoin Core withheld the technical details until the final vulnerable release in the 29.x series reached end of life. Developers typically postpone such disclosures until most nodes have upgraded.
The same disclosure batch covered two additional vulnerabilities corrected in version 30.0. One vulnerability could interrupt block processing. The other vulnerability incorrectly gave permissions to inbound Tor connections. The disclosure came after an October batch covering three other vulnerabilities identified by Project Loupe, an AI-powered scanner. Operators still using versions 28.0 through 29.1 should upgrade immediately. Restarting an affected node also returns the mempool to a clean state.
Bitcoin Core Patches High-Severity Mining Node Flaw CVE-2025-62861
BeInCryptoShare
Summary
Bitcoin Core released patches for a high-severity flaw (CVE-2025-62861) that could stop mining nodes from creating new blocks. The issue, tied to mempool corruption during chain reorgs, affected versions 28.0–28.2 and 29.0–29.1. Fixes arrived in October 2025 with 30.0, 29.2, and 28.3. Full node operators are urged to upgrade.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.