Bitcoin Core discloses three patched security bugs including high-severity mining flaw

Bitcoin Core developers disclosed three previously patched security vulnerabilities on November 10, 2026, including high-severity flaw CVE-2025-62861, which corrupted node mempools during chain reorganizations and prevented block template creation. Patches shipped in October 2025 via Bitcoin Core 30.0, but details were delayed 396 days under standard security policy until version 29.x reached end of life on October 27, 2026. No active exploits have been reported.

Overview of disclosed security flaws

• ▪The three Bitcoin Core security flaws disclosed on November 10, 2026, consisted of one high-severity bug and two medium-severity bugs affecting Bitcoin node operators, miners, and Tor network users
• ▪Bitcoin Core developers disclosed three security vulnerabilities, covering denial-of-service and privacy issues with no reported active exploitation

Medium-severity vulnerabilities

• ▪Medium-severity flaw CVE-2025-62860 caused thousands of Bitcoin nodes using the optional -whitelist configuration to inadvertently grant unthrottled permissions to all inbound Tor connections
• ▪Medium-severity flaw CVE-2025-62859, reported by Eugene Siegel in April 2025, permitted malicious peers to stall a Bitcoin node's block processing by sending manipulated compact blocks

Fixes and delayed disclosure timeline

• ▪Bitcoin Core fixed all three security vulnerabilities in release v30.0 on October 10, 2025, and release v29.2 on October 14, holding back public advisories for 396 days
• ▪Bitcoin Core developers delayed the public disclosure of the three security advisories until October 27, 2026, when the last vulnerable software release branch, version 29.x, reached official end of life