Bitcoin Core Discloses Three Security Bugs That Could Disrupt Bitcoin Mining and Node Operations

Bitcoin Core has publicly disclosed three security vulnerabilities that affected its node software, including one high-severity flaw capable of preventing certain mining nodes from creating valid blocks. The other two bugs involved delays in block processing and a weakness in how some nodes handled incoming connections through the Tor network.

The disclosures were published on November 10, 2026, even though developers had already released fixes for all three issues more than a year earlier. The vulnerabilities were patched in Bitcoin Core updates released in October 2025.

The most serious issue could leave an affected mining node unable to produce new block templates until its operator restarted the software. However, the advisories do not report evidence that any of the three vulnerabilities was exploited.

One Vulnerability Could Disrupt Bitcoin Mining

The most serious issue, tracked as CVE-2025-62861, received a high-severity rating. It affected Bitcoin Core versions 28.0 through 28.2 and versions 29.0 through 29.1.

The vulnerability involved TRUC transactions and Bitcoin Core's mempool, which stores unconfirmed transactions waiting to be included in blocks.

A problem could occur during a blockchain reorganization, when a node replaces recently accepted blocks with a different chain. During this process, transactions from the removed blocks are returned to the mempool.

Bitcoin Core's transaction replacement rules could incorrectly remove a restored transaction while leaving transactions that depended on it. This created an inconsistent mempool, preventing the affected node from assembling a valid block template.

For mining operators, the consequences could be significant because the node would remain unable to produce blocks until it was restarted.

Niklas Goegge reported the vulnerability in September 2025, and developers addressed it through an update to the software.

Tor Connections Could Receive Unintended Trusted Access

The second vulnerability, CVE-2025-62860, involved Bitcoin Core's optional -whitelist setting.

This feature allows node operators to designate certain network connections as trusted. Trusted peers receive different treatment, including exemptions from some denial-of-service protections and privacy safeguards.

The problem appeared when Bitcoin Core was configured to trust an IP address range that also included the address used by its Tor service.

Because incoming Tor connections could appear to originate from the local Tor service's address, the software could mistakenly treat outside Tor users as trusted peers. This effectively gave those connections privileges intended for explicitly trusted devices.

Bitcoin Core reported that thousands of reachable mainnet nodes may have been affected by configurations that enabled this behavior. Nodes that did not use the optional whitelist setting were not affected.

Martin Zumsande and Antoine Poinsot reported the issue in September 2025. Developers subsequently changed how incoming Tor connections receive whitelist permissions.

Third Bug Could Delay Bitcoin Block Processing

The third vulnerability, CVE-2025-62859, was rated medium severity and affected the way Bitcoin Core handled compact blocks.

Compact blocks are designed to help nodes receive newly announced blocks more efficiently by reducing the amount of data that needs to be transferred.

However, a malicious peer could exploit a weakness involving manipulated transaction witness data during compact-block processing. This could cause a node to delay processing a block for up to 10 minutes while waiting for another request to complete.

Under certain configurations, including nodes operating in -blocksonly mode or those whose high-bandwidth peers were controlled by an attacker, the delay could be repeated.

Eugene Siegel reported this vulnerability in April 2025, and developers included a fix in subsequent Bitcoin Core releases.

All Three Vulnerabilities Have Already Been Patched

Bitcoin Core released fixes for the three issues in October 2025. The updates included versions 30.0 and 29.2, with fixes also backported to older supported release branches.

The vulnerabilities were publicly disclosed after the Bitcoin Core 29.x release series reached end of life on October 27, 2026. This followed the project's disclosure process, which allows developers to publish details after affected software versions are no longer maintained.

The three issues are separate from another group of vulnerabilities that Bitcoin Core disclosed in late October 2026.

What Bitcoin Node Operators Should Do

Although the vulnerabilities have already been fixed, the disclosures are a reminder that node operators should keep their software updated.

Anyone running Bitcoin Core should check their installed version and upgrade to a currently maintained release. Operators using bundled Bitcoin node packages should also verify which Bitcoin Core version is included, rather than relying only on the package's overall update status.

Ordinary Bitcoin holders who use exchanges, hardware wallets or lightweight wallet applications generally do not need to take action specifically because of these node-software vulnerabilities. The disclosed issues affected Bitcoin Core node operations and did not provide a reported method for stealing users' coins.

The latest disclosures highlight the importance of security reviews and timely software updates across the Bitcoin ecosystem. While none of the three bugs was reported as exploited, they show how weaknesses in node software can affect mining operations, network reliability and connection security.