TheBlock
Bitcoin Core disclosed three patched vulnerabilities, including a high-severity bug that could stop affected mining nodes from creating valid block templates until restarted. The mining flaw, CVE-2025-62861, affected versions 28.0 through 28.2 and 29.0 through 29.1. Fixes for all three issues shipped in October 2025.
Why it matters
The mining bug involved transaction handling after a chain reorganization. Bitcoin Core's TRUC sibling eviction rules could remove a transaction without removing its descendants, leaving the mempool inconsistent and disrupting block-template creation.
A second, medium-severity flaw, CVE-2025-62859, let a malicious peer delay block processing by up to 10 minutes through witness malleation in compact blocks. The advisory said the attack could be repeated indefinitely against nodes in blocksonly mode or when the attacker controlled all three high-bandwidth peers.
The third issue, CVE-2025-62860, could grant incoming Tor peers whitelist permissions when a node's optional whitelist range included its Tor proxy. Bitcoin Core said thousands of reachable mainnet nodes had been whitelisting incoming Tor connections, removing some denial-of-service limits and privacy protections. Nodes without the non-default whitelist setting were unaffected.
Market impact
Bitcoin Core software is used by many Bitcoin nodes, and the flaws affected mining operations, block processing and node protections rather than introducing a new change to the Bitcoin protocol. The disclosure provides node operators with details to assess their exposure against their software version and configuration.
Bitcoin Core 30.0 shipped fixes on Oct. 10, 2025, followed by version 29.2 on Oct. 14, 2025.
Frequently asked questions
-
Which Bitcoin Core versions were affected by the mining flaw?
CVE-2025-62861 affected Bitcoin Core versions 28.0 through 28.2 and 29.0 through 29.1. Affected mining nodes had to restart before they could create valid block templates again.
-
How could the mining vulnerability disrupt block-template creation?
After a chain reorganization, transaction eviction could remove a transaction without removing its descendants. That left the mempool inconsistent and disrupted block-template creation.
-
How long could the compact-block flaw delay processing?
A malicious peer could delay block processing by up to 10 minutes. The advisory said the attack could be repeated indefinitely under certain node or peer conditions.
-
Which nodes were exposed to the Tor whitelist issue?
The flaw affected nodes using the optional whitelist setting when its IP range included the Tor proxy. Nodes without the non-default whitelist setting were unaffected.
-
Which Bitcoin Core releases include fixes for all three flaws?
Bitcoin Core 30.0 included fixes when it shipped on Oct. 10, 2025. Version 29.2 followed with fixes on Oct. 14, 2025.
CryptoSlate
Crypto News
WuBlockchain
CoinDesk
WatcherGuru