Bitcoin Core Details 3 Patched Security Vulnerabilities

What Happened with BitcoinBTC+1.28% Core?

Bitcoin Core developers have officially shared details about three security vulnerabilities that were previously discovered and fixed in the software.

Bitcoin Core is the open-source software that powers nodes on the Bitcoin network. Because these nodes validate transactions and maintain the blockchain, keeping the software secure is critical.

The latest disclosure includes one high-severity vulnerability and two medium-severity bugs. All three issues were fixed in October 2025 software updates before public advisories were published on November 10.

The High-Severity Flaw: Disrupting Bitcoin Mining

The most serious issue disclosed is tracked as CVE-2025-62861. Developers classified it as a high-severity vulnerability because it had the potential to disrupt how miners produce new blocks.

To understand how this bug works, it helps to understand two key concepts:

• Block Reorganization (Reorg): Occurs when the network briefly splits and replaces previously accepted blocks with an alternative, longer chain.
• The Mempool: The holding area inside a node where unconfirmed transactions wait before miners add them to a block.

The vulnerability could create an inconsistent state in a node's mempool right after a blockchain reorganization took place. This state inconsistency could stop affected miners from successfully creating new blocks.

Security researcher Niklas Goegge reported the bug on September 26, 2025. The flaw impacted Bitcoin Core software versions 28.0 through 28.2 and versions 29.0 through 29.1.

Two Medium-Severity Vulnerabilities Detailed

In addition to the mining issue, developers shared details on two medium-severity bugs that were also previously patched.

1. Block Processing Delay (CVE-2025-62859)

The first medium-severity bug allowed malicious actors to slow down block processing times by manipulating transaction witness data.

In specific scenarios, an attacker could force an affected node to wait up to 10 minutes before processing a single block. On nodes running specific configurations, this attack could be repeated indefinitely. Researcher Eugene Siegel discovered this flaw in April 2025.

2. Tor Network Permission Vulnerability (CVE-2025-62860)

The second medium-severity issue affected Bitcoin nodes operating over Tor, an anonymity network. Developers revealed that thousands of reachable mainnet nodes running Tor had been granting unauthorized permissions for incoming connections.

This issue only impacted nodes using an optional whitelist configuration. Nodes operating without this custom configuration remained unaffected.

Why Details Were Kept Quiet Until Now

The delay in releasing these details follows standard Bitcoin Core security disclosure protocols. Developers usually wait at least two weeks after the end of life of affected software versions before releasing technical details.

This policy gives node operators and miners time to upgrade to secure software versions without exposing active systems to potential exploits.

How the Security Fixes Were Deployed

All three vulnerabilities were resolved across multiple Bitcoin Core releases in October 2025:

• Bitcoin Core 30.0: Released on October 10, 2025, containing fixes for all three issues.
• Bitcoin Core 29.2: Released on October 14, 2025, with backported security fixes.
• Bitcoin Core 28.3: Updated specifically to patch the high-severity mining bug.

Node operators running these updated versions or newer are protected from all three vulnerabilities. Maintaining up-to-date node software remains the recommended best practice for Bitcoin network participants.