• Bitcoin Core disclosed three now-patched security flaws in the software running most of the network’s nodes, covering denial-of-service and privacy issues rather than anything enabling coin theft or forgery.
  • The most serious could corrupt a node’s mempool during a chain reorganization, halting a miner’s ability to create block templates until restarted.
  • None reached Bitcoin Core’s “critical” tier, and no exploitation was reported.

Bitcoin Core developers have disclosed three security vulnerabilities in the software that runs most of the Bitcoin network, including one high-severity bug that could disrupt mining, all of which have since been fixed.

The flaws, detailed in a batch of security advisories, span denial-of-service and privacy issues rather than anything that would let an attacker steal coins or forge Bitcoin.

Bitcoin Core, the reference software operating the majority of the network’s nodes, classifies vulnerabilities into four tiers, from “low” to “critical,” and these fell into the middle of that range.

BTC Lows in November

The most serious, tracked as CVE-2025-62861, concerns block template creation, the process miners rely on to assemble new blocks.

According to the advisory, a chain reorganization could trigger an erroneous eviction of certain transactions, corrupting a node’s mempool, its waiting room for unconfirmed transactions, so that an affected node could no longer build block templates until it was restarted. For a miner, that means a halt to the very work that earns block rewards.

A second flaw, CVE-2025-62859, could let a peer stall a node’s block processing by announcing a compact block with a manipulated witness, a form of transaction malleation.

The third, CVE-2025-62860, was a privacy and security issue in which inbound connections over the Tor anonymity network were wrongly granted “whitelist” permissions, lifting various denial-of-service and privacy protections on affected nodes.

None of the three rises to the “critical” level Bitcoin Core reserves for bugs that threaten coin theft at the protocol level, unauthorized coin creation or permanent network-wide chain splits. The developers did not report any evidence the flaws were exploited.

The disclosures come amid a broader reckoning over how quickly Bitcoin’s defenders can keep pace with a shifting threat landscape.

Bitcoin Core recently rewrote its security policy to account for AI, adding a category for “easily discoverable” vulnerabilities that can be surfaced through a simple AI prompt, which it now patches and discloses immediately rather than holding under a long embargo.

That shift reflects mounting concern that large language models have lowered the bar for finding flaws, a worry underscored by the volunteer “Bitcoin Red Team,” which has been racing to uncover AI-discoverable bugs across the ecosystem before attackers can exploit them.

The fixes themselves shipped earlier, with the advisories following under Bitcoin Core’s disclosure timeline. Node operators are generally urged to run the latest software to stay protected.

Daily Debrief Newsletter

Start every day with the top news stories right now, plus original features, a podcast, videos and more.