Bitcoin Core developers have publicly disclosed three security vulnerabilities that were reported during 2025 and patched in October of that year, including a high-severity flaw capable of disrupting mining node operations by preventing the creation of valid block templates.
The most serious issue, tracked as CVE-2025-62861, affected Bitcoin Core versions 28.0 through 28.2 and 29.0 through 29.1. Reported by security researcher Niklas Goegge on September 26, 2025, it stemmed from transaction-handling rules continuing to be applied after certain transactions returned to the mempool following a chain reorganization. As a result, a transaction could be removed without also removing its descendants, leaving an inconsistent mempool state. Affected nodes needed restarts before they could resume generating valid block templates, a serious problem for miners requiring uninterrupted node performance.
A second vulnerability, CVE-2025-62859, was reported by Eugene Siegel in April 2025. It allowed a malicious peer to exploit witness malleation in compact blocks to delay block processing by up to 10 minutes. The advisory noted the attack could be repeated indefinitely against nodes operating in -blocksonly mode or when an attacker controlled all three high-bandwidth peers.
The third issue, CVE-2025-62860, affected nodes using the optional -whitelist setting. Under certain configurations, incoming Tor peers could receive whitelist permissions if the proxy’s IP address fell within an approved range. Bitcoin Core said thousands of reachable mainnet nodes had been whitelisting incoming Tor connections, weakening some denial-of-service protections and privacy safeguards. Nodes that did not use the non-default whitelist setting were unaffected.
Fixes for all three vulnerabilities were included in Bitcoin Core 30.0 on October 10, 2025, and in version 29.2 on October 14, 2025. The high-severity mining flaw was also patched in Bitcoin Core 28.3. The last vulnerable release reached end-of-life on October 27, 2025, and the public disclosure followed Bitcoin Core’s security policy of waiting at least two weeks after the end of life of the last affected version before publishing medium- or high-severity details.
