Bitcoin Core announced on November 10, 2026 that three security flaws—one rated high severity and two rated medium—had been patched in October 2025. The vulnerabilities impacted miners, node operators and users of Tor connections, but only affect software versions that are no longer supported.
Details of the vulnerabilities
CVE-2025-62861 (high severity) affected block template creation during chain reorganizations involving TRUC transactions. The bug could prevent miners from generating a valid block template and was present in versions 28.0‑28.2 and 29.0‑29.1.
CVE-2025-62860 (medium severity) related to the optional -whitelist setting for Tor connections, granting trusted permissions to inbound Tor peers. This issue affected nodes that used the non‑default whitelisting configuration with Tor.
CVE-2025-62859 (medium severity) involved compact block processing, allowing a malicious peer to stall block processing for roughly ten minutes. The flaw was reported in April 2025.
Patch timeline and public disclosure
All three bugs were back‑ported and included in Bitcoin Core releases from October 2025. Bitcoin Core 30.0, released on October 10, 2025, contained the fixes. The public disclosure followed the end of support for the affected 29.x line on October 27, 2026.
Implications for the network
Operators running Bitcoin Core 30.0 or any patched release from October 2025 are protected. No active exploits have been reported. The remaining risk is limited to miners still using versions 28.0‑28.2 or 29.0‑29.1 and node operators employing the -whitelist flag with Tor.
