Bitcoin Core, the open-source software that runs Bitcoin nodes, disclosed three security bugs on Nov. 10, fixed more than a year earlier. One, CVE-2025-62861, is rated High severity. The other two, CVE-2025-62860 and CVE-2025-62859, are rated Medium. A CVE (Common Vulnerabilities and Exposures) number is a known flaw's public ID.

All three fixes shipped in Bitcoin Core 30.0 on Oct. 10, 2025, and in 29.2 four days later. By Unchained's count, 396 days separated that release from disclosure. The write-ups came after the last vulnerable release line, 29.x, reached end of life on Oct. 27, 2026. The advisories do not say whether any bug was exploited.

These are separate from three AI-found bugs Bitcoin Core disclosed without its usual embargo on Oct. 28; that round's release notes said three more bugs fixed in 30.0 were due in two weeks.

Get Unchained's crypto news in your inbox with the free Unchained Daily newsletter.

A Mining Node That Can't Build Blocks

The High-rated bug sat in the mempool, each node's pool of unconfirmed transactions. It involved TRUC (version 3) transactions, which are limited to one unconfirmed parent and one unconfirmed child. Version 28.0 added a "sibling eviction" rule that drops an existing child for a better-paying one.

That rule kept firing during a chain reorganization, when a node swaps recent blocks for a competing chain and returns their transactions to the mempool. It could remove a restored transaction while keeping those spending it. Per the advisory, the miner's block template then fails validation, so the node "cannot produce blocks until it is restarted." Versions 28.0 to 28.2 and 29.0 to 29.1 were affected. Niklas Goegge reported it in September 2025.

Tor Peers Treated as Trusted

The second bug only hit nodes using the optional -whitelist setting, which relaxes denial-of-service limits and privacy protections for trusted peers. Inbound Tor connections carry the local Tor daemon's address, so whitelisting a range covering that daemon gave every Tor peer the same permissions. Vendors bundling Bitcoin Core with Tor set it that way, which the project said led to "thousands of reachable mainnet nodes whitelisting all incoming Tor connections." Martin Zumsande and Antoine Poinsot reported it, and Poinsot alerted Bitcoin Knots maintainer Luke Dashjr and several affected providers in September 2025.

The third bug let a malicious peer stall a node's block processing by abusing its handling of compact blocks, a bandwidth-saving way of relaying new blocks. In some setups the stall could repeat indefinitely. Eugene Siegel reported it in April 2025.

29.2 and 30.0 are the first releases fixing all three, per the advisories' timelines.

Related Listen: When Could Quantum Computers or AI Break Bitcoin? An Updated Threat Window