Bitcoin Core disclosed on Tuesday, November 10, the details of three vulnerabilities fixed in 2025, one of them rated high severity because it could stop a mining node from producing blocks after a chain reorganization. The disclosure came two weeks after the last affected version, 29.x, reached end of life on October 27, 2026.
The three vulnerabilities
The advisories were added to the official site through a GitHub pull request opened by darosior and merged by fanquake the same day. The PR description says the bugs were pre-announced two weeks earlier alongside the 32.1 release.
- CVE-2025-62859 - block processing could be stalled by a peer announcing a compact block with a malleated witness
- CVE-2025-62860 - inbound Tor connections wrongly received -whitelist permissions, lifting DoS and privacy protections
- CVE-2025-62861 - block template creation halted by TRUC (v3) sibling eviction during a reorg
CVE-2025-62861 is rated high severity in the published advisory.
How the high-severity bug worked
TRUC transactions (version 3, defined in BIP 431) may have at most one unconfirmed ancestor and one unconfirmed descendant in the mempool. When a new transaction would give a TRUC parent a second unconfirmed child, the sibling eviction logic introduced in v28.0 evicts the existing child under replace-by-fee rules if the new transaction pays enough.
These are mempool policy rules, not consensus rules, so a valid block can contain any topology. During a reorg, transactions from disconnected blocks are re-added to the mempool with bypass_limits=true, but the TRUC check was not gated on that flag and still ran.
The result: a restored transaction could be evicted while its descendants stayed in the mempool, spending outputs that no longer existed. A miner's assembled block template then failed its validity check, and the node could not produce blocks until a restart reloaded the mempool in a consistent state.
Who was affected and when it was fixed
The fix landed in PR #33504, opened by Greg Sanders, which gates the TRUC checks on bypass_limits. The bug was discovered and responsibly disclosed by Niklas Goegge.
Date | Event |
|---|---|
Sep 26, 2025 | Niklas Goegge reports the bug to the security mailing list |
Oct 2, 2025 | PR #33504 merged into master |
Oct 10, 2025 | Bitcoin Core 30.0 released with the fix |
Oct 14, 2025 | Bitcoin Core 29.2 released with the fix |
Oct 17, 2025 | Bitcoin Core 28.3 released with the fix |
Oct 27, 2026 | Last vulnerable version (29.x) reaches end of life |
Nov 10, 2026 | Public disclosure |
Disclosure policy
Under Bitcoin Core's security policy, medium and high severity vulnerabilities are disclosed two weeks after the last affected release goes end of life, roughly a year after the major version containing the fix was first released.
A pre-announcement goes out two weeks before, coinciding with a new major release, and lists the number of fixed vulnerabilities and their severity levels. If you still run a node on 28.0-28.2 or 29.0-29.1, it is affected; the latest maintenance releases, 29.5 and 30.4, shipped on October 28, 2026.