Bitcoin Core patches three security flaws affecting mining and Tor-connected nodes

Traders Union
All News
Crypto
Bitcoin Core Security Flaws Patched

Bitcoin Core has disclosed three security vulnerabilities that were fixed in October 2025, including a high-severity bug that could stop affected mining nodes from generating valid block templates. The issues also included weaknesses that could delay block processing and grant trusted permissions to incoming Tor connections under certain non-default settings.

Highlights

Bitcoin Core fixed three security flaws in versions 28.0–29.1 and 29.2–30.0, with patches released on Oct. 10 and Oct. 14, 2025.
The most severe bug, CVE-2025-62861, risked mempool inconsistency and invalid block template creation for miners until node restart.
The Tor-related CVE-2025-62860 granted unintended whitelist permissions to thousands of nodes, removing DoS limits and privacy protections for Tor peers.

Patched flaws and affected versions

The high-severity flaw, CVE-2025-62861, affected Bitcoin Core versions 28.0 to 28.2 and 29.0 to 29.1. Niklas Goegge reported the bug on Sept. 26, 2025, and Bitcoin Core said its TRUC sibling eviction rules continued to apply to transactions returning to the mempool after a chain reorganization, which could leave the mempool in an inconsistent state.

For miners running affected nodes, the issue could evict a transaction without removing its descendants, preventing valid block templates from being created until the node was restarted. A separate medium-severity flaw, CVE-2025-62859, reported by Eugene Siegel in April 2025, allowed a malicious peer to exploit witness malleation in compact blocks and delay block processing by up to 10 minutes.

Operational and network impact

Bitcoin Core said thousands of reachable mainnet nodes had been whitelisting incoming Tor connections under those configurations. Nodes that did not use the non-default whitelist setting were not affected.

The advisories also said the attack tied to CVE-2025-62859 could be repeated indefinitely against nodes running in -blocksonly mode, or where an attacker controlled all three high-bandwidth peers. The last vulnerable Bitcoin Core version reached end of life on Oct. 27, 2026.

The disclosure follows another security episode reported earlier in 2026. In May, The Block reported that developers had patched a separate high-severity memory safety vulnerability before publicly disclosing it.

We recently wrote about Cohere AISLE acquisition as the company sought to add AI-driven software vulnerability detection to its enterprise security push.