Bitcoin Core Discloses Three Vulnerabilities, Including a High-Severity Bug That Can Stop Miners Building Blocks

Published November 11, 2026, 8:40 AM PKT. Based on the Bitcoin Core security advisories published November 10, 2026 (primary source) and reporting by SecurityOnline.info and KuCoin News (secondary sources).

Bitcoin Core disclosed three security vulnerabilities on November 10, 2026, one rated High severity and two rated Medium, in the software that runs most of the Bitcoin ($BTC) network's full nodes and mining operations.

The worst of the three, tracked as CVE-2025-62861, can stop a mining node from creating block templates after a chain reorganization, leaving it unable to produce blocks until it is restarted, according to the Bitcoin Core advisory. A second flaw, CVE-2025-62860, gave inbound Tor connections trusted whitelist permissions on thousands of reachable mainnet nodes. The third, CVE-2025-62859, lets a malicious peer stall a victim node's block processing by manipulating witness data in compact blocks.

All three bugs are already fixed. The patches shipped in Bitcoin Core versions 30.0, 29.2 and 28.3 in October 2025, and the disclosure came only after the last affected release went end of life, following the project's standard timeline. Developers have confirmed no active attacks in the wild and no public exploit tools for these bugs, according to SecurityOnline.info.

The high-severity bug: a reorg can stop a miner cold

CVE-2025-62861 is a mempool inconsistency tied to version 3 transactions, known as TRUC, which follow the topology rules in BIP 431. A TRUC transaction may have at most one unconfirmed ancestor and at most one unconfirmed descendant in the mempool, but those are policy rules, not consensus rules, so a valid block can contain a TRUC parent with several children, the advisory explains.

During a chain reorganization, the transactions from the disconnected blocks are put back into the mempool with a flag called bypass_limits set to true, which is meant to restore previously confirmed transactions faithfully, without applying mempool anti-denial-of-service or topology policy. The bug was that the sibling-eviction branch was not gated on bypass_limits, so TRUC enforcement still ran while transactions were being re-added, according to the advisory.

A reorg can therefore restore a transaction topology that breaks the TRUC descendant limit, valid in a block but impossible to form in the mempool. Re-adding such transactions with sibling eviction still active could evict a restored transaction while leaving its in-mempool descendants behind, so the mempool held transactions spending outputs that no longer existed.

The main effect is that a miner's block template creation can no longer succeed. The assembled template fails its validity check, so a node that performed such a reorg cannot produce blocks until it is restarted, which reloads the mempool in a consistent state, the advisory states. The bug affects versions 28.0 to 28.2 and 29.0 to 29.1.

Niklas Goegge discovered the issue and reported it to the Bitcoin Core security mailing list on September 26, 2025. Greg Sanders opened the fix, pull request 33504, three days later, and it was merged on October 2, 2025 and backported to the 28.x and 29.x branches. Bitcoin Core 30.0 shipped with the fix on October 10, 2025, followed by 29.2 on October 14 and 28.3 on October 17.

Thousands of nodes gave Tor peers trusted status

CVE-2025-62860, rated Medium, covers a flaw in the -whitelist option. In Bitcoin Core, the IP address of inbound Tor peers is that of the Tor daemon, which usually runs on the same machine or local network. The -whitelist configuration lifts various denial-of-service limits and privacy leak mitigations for trusted peers, and Bitcoin Core would whitelist inbound Tor connections if the address of the Tor proxy matched the IP range configured through the option, according to the advisory.

Popular vendors bundled Bitcoin Core with a Tor daemon and set the -whitelist option to an IP range matching that of the Tor daemon, and the option was also an operational requirement for client software of Bitcoin Core that commonly ran alongside a Tor daemon. This led to thousands of reachable mainnet nodes whitelisting all incoming Tor connections, the advisory states.

Nodes that did not set the non-default -whitelist option were never affected. Inbound Tor connections received on an onion bind are never whitelisted in Bitcoin Core 30.0 and later versions, as well as 28.3 and later minor versions and 29.2 and later minor versions.

Martin Zumsande and Antoine Poinsot discovered the issue and reported it to the Bitcoin Core security team on September 12, 2025. Poinsot also reported it to Bitcoin Knots maintainer Luke Dashjr on September 17, 2025, who acknowledged it the same day, and to several affected software providers on September 19. The fix shipped in 30.0 on October 10, 2025, in 29.2 on October 14 and in 28.3 on October 20.

A mutated witness could stall block processing

CVE-2025-62859, also rated Medium, involves witness malleation in compact blocks. Affected Bitcoin Core versions would clear the download state for a compact block after reconstruction but before checking for witness malleation. If that check failed, the node would fall back to requesting the block from the same peer through GETDATA, with a 10-minute timeout, according to the advisory.

A malicious peer that announced a compact block to a victim first could leverage the defect to stall the victim's block processing. If the attacker controlled the victim's three high-bandwidth peers, or if the victim was running with the -blocksonly option, the stall could be repeated indefinitely, the advisory states.

Eugene Siegel discovered the issue and reported it to the Bitcoin Core security list on April 28, 2025. Gregory Sanders opened the fix, pull request 32646, on May 30, 2025, and it was merged on June 30 and backported to version 29 in September. The fix shipped in Bitcoin Core 30.0 on October 10, 2025 and in 29.2 on October 14.

What node operators should do

Anyone still running an affected version should upgrade to Bitcoin Core 30.0, 29.2 or 28.3, where all three bugs are fixed. Operators who cannot patch the Tor whitelist flaw immediately should remove local Tor proxy IP addresses from their -whitelist settings, according to SecurityOnline.info.

The urgency is highest for miners, who face the block-template failure in CVE-2025-62861, and for nodes running with -blocksonly or with -whitelist configured over a local range, which face the repeatable stall and the trusted-peer exposure. Ordinary users running current releases, and nodes that never set -whitelist, were never exposed to the Tor flaw.

Disclosed a year after the fixes shipped

The November 10 disclosure came about a year after the fixes were released, and two weeks after the last vulnerable Bitcoin Core version, the 29.x branch, went end of life on October 27, 2026. That is the project's standard timeline: Medium and High severity vulnerabilities are disclosed two weeks after the last affected release goes end of life, roughly a year after a major version containing the fix was first released.

The timing contrasts with a separate batch of three vulnerabilities disclosed on October 28, 2026, which skipped the embargo under Bitcoin Core's new policy for flaws classed as easily discoverable, meaning they can be found with minimal effort, such as through a simple language-model prompt. The three flaws disclosed on November 10 followed the normal embargo instead, because they were reported through the security mailing list in 2025 and fixed before the fast-track policy took effect.

For node operators, the message is straightforward. The bugs are patched, the details are now public, and the remaining risk sits with anyone still running a version from before October 2025.

Sources

• Bitcoin Core, CVE-2025-62861, Block template creation halted by TRUC sibling eviction during reorg, published November 10, 2026 (primary source: High severity; a chain reorganization could trigger erroneous sibling eviction of TRUC (v3) transactions, corrupting the mempool so an affected node can no longer create block templates until it is restarted; affected versions 28.0 to 28.2 and 29.0 to 29.1; fix released October 10, 2025 in Bitcoin Core v30.0, with 29.2 on October 14 and 28.3 on October 17; discovered by Niklas Goegge, reported September 26, 2025; fix in PR 33504 by Greg Sanders)
• Bitcoin Core, CVE-2025-62860, Inbound Tor connections wrongly receive -whitelist permissions, published November 10, 2026 (primary source: Medium severity; Bitcoin Core before versions 28.3, 29.2 and 30.0 would include Tor inbound peers in a whitelist configured over an IP range; the -whitelist configuration lifts various DoS limits and privacy leak mitigations for trusted peers; popular vendors bundled Bitcoin Core with a Tor daemon and set the option to a matching IP range, which led to thousands of reachable mainnet nodes whitelisting all incoming Tor connections; nodes that did not set the non-default -whitelist option were never affected; discovered by Martin Zumsande and Antoine Poinsot, reported September 12, 2025; fix in 30.0 on October 10, 2025, 29.2 on October 14 and 28.3 on October 20)
• Bitcoin Core, CVE-2025-62859, Block processing stall via witness malleation, published November 10, 2026 (primary source: Medium severity; block processing in Bitcoin Core before versions 29.2 and 30.0 may be stalled by a malicious peer exploiting witness malleation in compact blocks; the node would clear download state before checking for witness malleation, then fall back to a GETDATA request with a 10-minute timeout; repeatable indefinitely if the attacker controlled the victim's three high-bandwidth peers or the victim ran with -blocksonly; discovered by Eugene Siegel, reported April 28, 2025; fix in PR 32646 by Gregory Sanders, released in 30.0 on October 10, 2025 and 29.2 on October 14)
• SecurityOnline.info, Bitcoin Core Vulnerabilities CVE-2025-62861 and 2 Patched, published November 10, 2026 (secondary source: the three bugs affect block templates, Tor peer rules and compact block sync; node operators on older builds must update to versions 30.0, 29.2 or 28.3 right away; developers confirm no active attacks in the wild or public exploit tools exist for these bugs; operators who cannot patch CVE-2025-62860 now should remove local Tor proxy IPs from their -whitelist settings)
• KuCoin News, Bitcoin Core Discloses Medium-Risk Vulnerability Affecting Block Processing in Versions Prior to 29.2 and 30.0, published November 11, 2026 (secondary source: medium-severity vulnerability CVE-2025-62859 was made public on November 10, 2026; a malicious node can exploit witness data manipulation within compact blocks to stall a victim's block processing under specific conditions; if verification fails, the node switches to requesting a full block from the same peer and waits for a 10-minute timeout)

This article is news reporting and is not investment advice.