Bitcoin Core discloses three bugs fixed in 2025, one rated high severity
One could stop a mining node from building blocks after a reorganization. Nodes on current versions are not affected.
Bitcoin Core published details of three security bugs on November 10, 2026, all fixed in releases from October 2025. One is rated high severity and two medium, according to the project's advisories. Developer Antoine Poinsot posted them to the Bitcoin-Dev mailing list, Bitcoin Optech reported on November 13.
Bitcoin Core is open-source software for running a bitcoin node, a computer that checks every transaction and block. Under the project's policy, medium- and high-severity bugs are made public 14 days after the last release series they affect stops getting fixes. For these bugs that was version 29, which reached that point on October 27, 2026.
The high-severity bug
The most serious bug mattered only to nodes that miners use to build blocks. Sometimes the network swaps recent blocks for a competing chain, which is called a reorganization. After certain reorganizations, the node's pool of waiting transactions could break. A node in that state could not build new blocks until it was restarted.
The fault sat in rules for a newer transaction type called TRUC, or version 3 transactions. It affected versions 28.0 to 28.2 and 29.0 to 29.1. Niklas Gögge reported it in September 2025, and the fix shipped in Bitcoin Core 30.0 on October 10, 2025.
The two medium-severity bugs
On some nodes, the second bug gave trusted status to every incoming connection through Tor, a network that hides users' internet addresses. It only hit nodes that used the optional -whitelist setting with an address range that included their Tor software. Some popular node packages shipped with that setup. The advisory says this led "thousands of reachable mainnet nodes" to trust every incoming Tor connection.
Trusted peers skip some of the node's limits against spam and some privacy protections. Martin Zumsande and Antoine Poinsot found the bug. Poinsot also told Luke Dashjr, maintainer of Bitcoin Knots, another node program, in September 2025, the advisory says. Versions 28.3, 29.2 and 30.0 fixed it.
The third bug let a peer delay a node's handling of a new block for up to 10 minutes. If the attacker controlled all three of the node's high-bandwidth peers, the ones that announce new blocks first, the delay could repeat indefinitely. Eugene Siegel reported it in April 2025, and versions 29.2 and 30.0 fixed it.
Every affected release series is now out of support, and Optech advised anyone still using one to move to a maintained version.
Nodes are how bitcoin users check the rules for themselves, so bugs in node software matter even when they are fixed. These were reported privately, fixed and shipped more than a year before the details went public, which gave operators time to upgrade. If you run a node, check that it is on a maintained version.
Sources (4)
- Bitcoin Core: CVE-2025-62861, Block template creation halted by TRUC sibling eviction during reorg
- Bitcoin Core: CVE-2025-62860, Inbound Tor connections wrongly receive -whitelist permissions
- Bitcoin Core: CVE-2025-62859, Block processing stall via witness malleation
- Bitcoin Optech Newsletter #431, November 13, 2026
Not financial advice. How we report and check stories.
Found this useful? Tip the desk in sats at our Lightning address, tips@orangewirebtc.com. Tips are voluntary. They buy no extra content and no influence over coverage.
Liked this? Get five stories like it every week, plus one chart and one explainer. Free. Subscribe →