Bitcoin Core Discloses Three Patched Bugs, Including a High-Severity Mining Flaw

Bitcoin Core published details of three security flaws on November 10, 2026. The fixes had already shipped in 2025; the disclosure is not a report of a new attack.

A high-severity bug could leave some Bitcoin Core nodes unable to build valid block templates after a chain reorganization. Two additional, medium-severity issues affected block processing and certain Tor configurations. Bitcoin Core disclosed all three on November 10, after the last affected 29.x release line reached end of life.

The timing matters. These are newly public explanations of vulnerabilities that developers say were fixed in earlier software releases—not fresh patches prompted by an ongoing incident. The advisories do not say that the flaws were exploited, and none describes a change to Bitcoin’s consensus rules or a theft of users’ coins.

The mining issue: a mempool that could become inconsistent

The most serious issue, CVE-2025-62861, was rated High. It affected Bitcoin Core versions 28.0 through 28.2 and 29.0 through 29.1. The bug involved TRUC, or version 3, transactions and the rules Bitcoin Core uses to manage them in its mempool—the local waiting area for transactions that have not yet been confirmed.

Ordinarily, TRUC rules limit how unconfirmed transactions can be arranged around one another. During a chain reorganization, however, transactions from blocks that have been disconnected must be put back into the mempool. Bitcoin Core’s advisory says a “sibling eviction” rule was still being applied during that restoration, even though the re-added transactions were meant to bypass those policy limits.

In a narrow transaction arrangement, that could remove a transaction while leaving its descendants behind. The node would then hold transactions whose inputs were no longer available in its mempool view. The advisory says an affected miner’s node could fail to assemble a valid block template until it was restarted and the mempool reloaded consistently.

That is an availability problem for the affected software, not evidence that Bitcoin’s consensus rules accepted an invalid block. The project fixed the issue in Bitcoin Core 30.0, released October 10, 2025, and backported the fix to 29.2 and 28.3.

Two other flaws had different exposure conditions

CVE-2025-62859, rated Medium, concerned compact-block processing. Under certain conditions, a malicious peer could exploit witness malleation to make a node request a block again from the same peer and wait through a timeout of up to ten minutes. The advisory says repeated disruption was possible if an attacker controlled all three of a node’s high-bandwidth peers, or if the node was running with the `-blocksonly` option. This issue was fixed in versions 29.2 and 30.0.

CVE-2025-62860, also rated Medium, involved the optional `-whitelist` configuration. Bitcoin Core can apply different limits to connections it treats as trusted. If an operator’s configured address range matched the IP address of a Tor proxy, incoming Tor connections could mistakenly inherit those permissions. The project says this could relax some denial-of-service limits and privacy protections; nodes that did not use the non-default whitelist setting were not affected.

Bitcoin Core noted that some software providers bundled the node software with Tor and used a matching whitelist range, leading to thousands of reachable mainnet nodes applying the permissions to incoming Tor connections. The advisory records fixes in versions 28.3, 29.2 and 30.0.

Why the details appeared a year after the fixes

The dates reflect Bitcoin Core’s disclosure policy. The project says Medium- and High-severity bugs are generally disclosed two weeks after the last affected release line reaches end of life. The vulnerable 29.x line reached that point on October 27, 2026; the three advisories were published on November 10.

The fixes themselves were delivered much earlier. The high-severity report was sent to the security team in September 2025, and its fix was merged and released across the affected branches in October. The compact-block issue was reported in April 2025, while the Tor permissions issue was reported in September. The project’s timelines record each fix being backported before this month’s public write-ups.

Delayed disclosure can be frustrating for operators trying to assess old deployments, but it also gives people time to move off vulnerable release lines before technical details become public. Here, the project has documented the affected versions and the fixed versions in its advisories, allowing operators to check their own installations rather than infer risk from a headline.

What node operators should take from this

Anyone running Bitcoin Core should compare their exact version and configuration with the project’s advisory pages and upgrade to a currently supported release. The notes are especially relevant to miners, operators using `-blocksonly`, and installations that set `-whitelist` alongside Tor. The latter two issues depend on narrower conditions; the high-severity issue affected a specific range of older versions.

The newly published details do not mean that every node is exposed today. The listed vulnerable versions have corresponding fixed releases, and the advisories identify which settings mattered. Operators should follow the project’s official release and security notices, and should avoid treating a node restart as a substitute for installing a version containing the fix.

For Bitcoin users who do not operate a node, there is no indication in these advisories of a wallet compromise or a need to move funds. The story is about reliability and configuration in node software. It is a useful reminder that a decentralized network depends on many independently operated software clients—and that timely maintenance remains important even when a flaw is discovered and fixed quietly.

The bottom line

Bitcoin Core’s November 10 disclosures describe three distinct vulnerabilities, not one active attack: a High-severity mempool bug that could interrupt block-template creation after a reorganization, a conditional compact-block processing stall, and a Tor/whitelist permission issue. The fixes were released in 2025, and the detailed advisories followed the end of life of the last affected release line. Operators should check their version and settings against the primary notices; the disclosures themselves do not establish that the bugs were exploited or that Bitcoin’s consensus was at risk.