Bitcoin Core developers have identified and disclosed three significant security vulnerabilities affecting the popular open-source software that underpins much of the Bitcoin network. The most serious flaw, classified as high-severity, threatened the mining operations on the blockchain and could potentially have prevented miners from generating new blocks, thereby endangering network continuity.
High-severity mining flaw details
According to security advisories published on November 10, the critical vulnerability, tagged as CVE-2025-62861, had the potential to disrupt mining activities following a blockchain reorganization. During such an event, previously validated blocks can be replaced by an alternative chain, a mechanism designed to keep the chain secure but susceptible to rare edge-case bugs.
The flaw could have led to an inconsistent state within a node’s mempool, which holds all unconfirmed transactions waiting to be included in a new block. This could make it impossible for miners relying on affected node versions to correctly generate new blocks after certain types of reorganizations.
Security researcher Niklas Goegge reported the high-severity issue on September 26, 2025. The vulnerability affected Bitcoin Core versions 28.0 through 28.2 and 29.0 through 29.1.
Developers addressed this flaw in Bitcoin Core 28.3, as well as in the subsequent major releases 29.2 and 30.0 during October 2025, neutralizing the risk for nodes running these updated versions.
Mini dictionary: Bitcoin Core, the reference open-source software that implements the Bitcoin protocol, is maintained by a decentralized group of contributors and forms the backbone of the vast majority of nodes and miners on the Bitcoin network.
Medium-severity vulnerabilities affect block processing and network anonymity
In addition to the critical mining bug, Bitcoin Core developers outlined two further vulnerabilities rated as medium severity. The first, identified as CVE-2025-62859, could allow malicious actors to deliberately delay the processing of new blocks by targeting changes in transaction witness data. Under certain circumstances, the affected node could be forced to pause for up to ten minutes before resuming normal block handling.
Repeated exploitation of this vulnerability, especially in certain node configurations, could result in ongoing denial of service for targeted nodes. Eugene Siegel discovered this particular flaw in April 2025.
The final vulnerability, designated as CVE-2025-62860, related to the handling of connections over the Tor network. Bitcoin Core developers revealed that thousands of accessible Bitcoin mainnet nodes had granted permissions for inbound Tor connections, exposing them to potential risks. However, this vulnerability was limited to nodes using the optional whitelist configuration and did not impact others.
Mini dictionary: Tor, short for “The Onion Router,” is an open-source software project that allows users to browse the internet anonymously by routing traffic through a decentralized network of relays.
Patches and timeline
Although details of these vulnerabilities have come to light through public security advisories, the Bitcoin Core team had already resolved all three issues before disclosure. Fixes were included in Bitcoin Core version 30.0 released on October 10, as well as in version 29.2 deployed on October 14, 2025. The most critical mining-related issue was also patched in version 28.3.
| Vulnerability | Severity | Impacted Versions | Patched in | Reporter |
|---|---|---|---|---|
| CVE-2025-62861 | High | 28.0–28.2, 29.0–29.1 | 28.3, 29.2, 30.0 | Niklas Goegge |
| CVE-2025-62859 | Medium | Unspecified | 29.2, 30.0 | Eugene Siegel |
| CVE-2025-62860 | Medium | Tor nodes using whitelist | 29.2, 30.0 | Bitcoin Core team |
Developers encouraged users operating on potentially affected Bitcoin Core versions to update as soon as possible, citing the importance of running the latest and most secure releases.
Major security updates in Bitcoin Core addressed mining, block processing, and Tor-related risks, ensuring continued reliability and security for network participants.
