Bitcoin Core developers have disclosed three security vulnerabilities in the software that operates most of the Bitcoin network, including a high-severity bug that could disrupt mining. All three have been fixed.
The advisories describe denial-of-service and privacy issues rather than flaws that could enable coin theft or forgery. Bitcoin Core ranks vulnerabilities from “low” to “critical”; the three fell in the middle of that range, and developers reported no evidence they were exploited.
Mempool corruption could halt block templates
The most serious flaw, CVE-2025-62861, affects block template creation, which miners use to assemble new blocks. A chain reorganization could cause an erroneous eviction of certain transactions, corrupting the node's mempool—the waiting area for unconfirmed transactions—so the node could no longer build block templates until restarted. For a miner, that would halt the work that earns block rewards.
Two other patched issues
CVE-2025-62859 could allow a peer to stall a node's block processing by announcing a compact block with a manipulated witness, a form of transaction malleation.
CVE-2025-62860 involved inbound connections over the Tor anonymity network being wrongly granted “whitelist” permissions, which lifted various denial-of-service and privacy protections on affected nodes.
None of the three reached Bitcoin Core's “critical” tier, which is reserved for bugs that threaten coin theft at the protocol level, unauthorized coin creation, or permanent network-wide chain splits.
Security policy updated for AI-discoverable flaws
The disclosures follow a recent rewrite of Bitcoin Core's security policy to account for AI. The policy added a category for “easily discoverable” vulnerabilities that can be surfaced through a simple AI prompt, which are now patched and disclosed immediately rather than held under a long embargo.
That change reflects concern that large language models have lowered the bar for finding flaws. A volunteer “Bitcoin Red Team” has been racing to uncover AI-discoverable bugs across the ecosystem before attackers can exploit them.
The fixes shipped earlier, with the advisories following under Bitcoin Core's disclosure timeline. Node operators are generally urged to run the latest software to stay protected.
