Bitcoin Core disclosed three security vulnerabilities on November 10, 2026, including a high-severity defect capable of disrupting mining operations and two additional weaknesses affecting block processing and Tor connections. Although developers patched the problems in October 2025, their technical details remained confidential until the disclosure date.
Mining Operations at Risk
The most serious vulnerability, identified as CVE-2025-62861, affected Bitcoin Core versions 28.0 through 28.2 and 29.0 through 29.1. The defect involved transaction handling during blockchain reorganizations, potentially leaving mining nodes unable to construct valid block templates.
The issue centered on version 3 transactions, commonly called TRUC transactions, which operate under specialized mempool restrictions. During a chain reorganization, Bitcoin Core could incorrectly evict transactions while retaining dependent transactions, creating inconsistencies within the transaction pool.
For miners, the consequences were significant. Affected nodes could fail block template validation, effectively preventing them from generating fresh mining work until restarted. Mining equipment could continue processing outdated templates, potentially forfeiting transaction fees and reducing operational efficiency.
Security researcher Niklas Goegge reported the defect on September 26, 2025. Developer Greg Sanders introduced a correction, merged October 2, that prevented the problematic transaction eviction behavior during reorganizations. The remedy appeared in Bitcoin Core versions 30.0, 29.2, and 28.3 throughout October 2025. Approximately 9% of reachable nodes continued advertising vulnerable versions around the disclosure date.
Two Additional Vulnerabilities
CVE-2025-62859, classified as medium severity, involved maliciously constructed compact blocks. An attacker could exploit improper handling of altered transaction witnesses to repeatedly delay block downloads. Under particular network conditions, including compromised high-bandwidth peer connections, the interference could continue indefinitely. Researcher Eugene Siegel identified the weakness in April 2025, and Gregory Sanders developed the correction, which reached Bitcoin Core versions 30.0 and 29.2.
CVE-2025-62860 exposed a separate problem involving inbound Tor connections and trusted-peer permissions. When operators configured Bitcoin Core's optional -whitelist setting to include their Tor daemon's address, incoming connections could mistakenly inherit privileges intended for trusted peers. Those exemptions weakened certain denial-of-service safeguards and privacy protections. Bitcoin Core indicated that thousands of reachable mainnet nodes were potentially affected, although standard configurations remained safe.
Disclosure Timeline
The November 10 announcements followed Bitcoin Core's established disclosure schedule. Developers withheld technical details until the final vulnerable major release line, 29.x, reached end-of-life status on October 27, 2026.
None of the vulnerabilities permitted bitcoin theft, unauthorized coin creation, or consensus failure, and no exploitation was reported. The mining vulnerability required specific reorganization conditions, meaning its consequences were confined to affected operators rather than Bitcoin itself.
