Bitcoin Core developers have publicly disclosed three security vulnerabilities affecting the reference software that powers the majority of the Bitcoin network’s nodes. The flaws, detailed in advisories released around November 10, 2026, range from denial-of-service risks to a high-severity issue that could halt a miner’s ability to produce new blocks. All three were resolved in software updates issued the previous October, and no evidence of exploitation has been reported.

None of the issues reached the project’s critical severity tier, which is reserved for bugs enabling coin theft, unauthorized coin creation, or permanent chain splits. The disclosures followed Bitcoin Core’s standard practice of releasing fixes first and publishing details later, after the last affected minor versions reached end of life.

High-Severity Mining Disruption After Reorganizations

The most serious vulnerability, tracked as CVE-2025-62861, involved block template creation—the process nodes use to assemble candidate blocks for miners. During a chain reorganization, in which a node replaces recently validated blocks with an alternative chain of equal or greater work, a rule governing sibling eviction of certain transactions could leave the mempool in an inconsistent state.

Specifically, the node might drop a restored transaction while retaining its descendants, resulting in leftover transactions that referenced funds no longer present in the active chain. Validity checks on the resulting block template would then fail, preventing the node from generating usable templates until it was restarted and its mempool rebuilt from scratch.

The flaw affected Bitcoin Core versions 28.0 through 28.2 and 29.0 through 29.1. Security researcher Niklas Goegge reported it on September 26, 2025. Developer Greg Sanders submitted the corresponding fix, which shipped in versions 28.3, 29.2, and 30.0 during October 2025.

Miners and mining pool operators running the vulnerable releases faced the primary operational risk. Once the mempool became inconsistent, the only immediate recovery method was a full node restart.

Two Medium-Severity Issues Involving Block Processing and Tor

A second vulnerability, CVE-2025-62859, allowed a peer to stall a node’s processing of new blocks. By announcing a compact block containing manipulated witness data, an attacker could force the target node to pause for as long as ten minutes before resuming normal operation. Repeated targeting could produce sustained denial-of-service conditions under certain configurations. Eugene Siegel identified the issue in April 2025. It was addressed in versions 29.2 and 30.0.

The third flaw, CVE-2025-62860, concerned nodes accepting inbound connections over the Tor anonymity network. In some cases, these connections were incorrectly granted whitelist permissions, which lifted certain denial-of-service and privacy protections that would otherwise apply. The issue was limited to nodes using the optional whitelist configuration and did not affect the broader network. It was also fixed in versions 29.2 and 30.0.

Patch Timeline and Operator Guidance

Bitcoin Core version 30.0, released on October 10, 2025, contained fixes for all three issues. Version 29.2 followed on October 14, 2025, and the high-severity mining bug was additionally backported to the 28.3 maintenance release. Disclosure occurred only after the final vulnerable 29.x series reached end of support, consistent with the project’s coordinated release process.

Node operators still running any of the affected versions are advised to upgrade promptly to a current release. Restarting a previously affected node restores a clean mempool state even before an upgrade, though running the latest software remains the recommended long-term measure. The project continues to encourage operators to stay current as part of routine network hygiene.