Bitcoin Core has released details of three security vulnerabilities affecting miners, node operators and Tor users. All three were fixed more than a year ago.
The disclosure was published on November 10, 2026. It describes one High-severity flaw and two Medium-severity flaws. The advisories do not indicate whether any of the bugs were exploited. The issues are relevant now only to anyone still using software that should have been retired long ago.
What the three bugs actually did
The main issue is CVE-2025-62861, which was rated High. It affected block-template creation during chain reorganizations involving TRUC transactions.
Some context may help. A block template is a draft block that a miner assembles before attempting to mine it. A chain reorganization occurs when nodes discard a few recent blocks in favor of a competing chain.
In combination, these conditions could leave a node unable to create a valid block template until it was restarted. Bitcoin Core describes the issue as something a reorganization could trigger, not as a deliberate attack. It affected Bitcoin Core versions 28.0 through 28.2 and 29.0 through 29.1. The flaw was reported on September 26, 2025.
The second issue, CVE-2025-62860, concerns Tor connection whitelisting. Bitcoin Core said inbound Tor peers could incorrectly inherit trusted permissions from the optional -whitelist setting. This relaxed some denial-of-service limits and privacy protections. Bitcoin Core said “thousands” of reachable nodes were whitelisting all incoming Tor connections.
The issue affected only operators using the non-default -whitelist option with an IP range that included their Tor proxy’s address. Some software bundles configure it that way. Nodes using the default settings were not affected.
The third flaw, CVE-2025-62859, involved compact block processing. It allowed a malicious peer to stall block processing for about 10 minutes at a time. The stall could be repeated indefinitely if the peer controlled all three of the victim’s high-bandwidth peers, or if the victim was running in -blocksonly mode. The issue was reported in April 2025.
Why the public is only learning about this now
All three vulnerabilities were backported and fixed in Bitcoin Core releases from October 2025. Bitcoin Core 30.0 was released on October 10, 2025, with the fixes already included.
The disclosure comes after support for Bitcoin Core 29.x ended on October 27, 2026. That was the final version line still affected.
Add A Comment
Comments are closed.