Three patched software flaws revealed, including mining bug

Developers behind the Bitcoin Core client publicly detailed three software vulnerabilities on Tuesday, November 11, 2026. While the flaws were only recently disclosed, the necessary code fixes were originally issued over a year prior, in October 2025. The public disclosure was delayed until the last susceptible iteration of the client reached end-of-life status on October 27, 2026.

The most critical of the newly detailed issues was a high-severity mining vulnerability tracked as CVE-2025-62861. Discovered and reported by Niklas Goegge on September 26, 2025, the flaw directly affected the mempool. Under specific conditions, the bug could completely prevent mining nodes from creating valid block templates in the aftermath of a chain reorganization.

The problem was rooted in the software's handling of Topologically Restricted Until Confirmation (TRUC) rules, which are designed to govern "Version 3" transactions, according to Blocktrainer.

James Hunt, Deputy Managing Editor at The Block, outlined the technical breakdown of the mempool error. "Bitcoin Core's TRUC 'sibling eviction' rules were still being applied to transactions returning to the mempool after a chain reorganization," Hunt stated.

Because of this application of rules, the network's transaction queue could become corrupted. "The bug could evict a transaction without removing its descendants, leaving the mempool inconsistent," Hunt explained.

The high-severity flaw was present in several older iterations of the client, specifically affecting versions 28.0 through 28.2, as well as versions 29.0 through 29.1.

Medium-severity block and connection flaws

Alongside the primary mining bug, developers released information on two medium-severity vulnerabilities. The earliest of the three issues, logged as CVE-2025-62859, was identified and reported by Eugene Siegel in April 2025.

This particular flaw targeted block processing mechanics and could be leveraged by bad actors to degrade performance. According to Hunt, "The vulnerability meant a malicious peer could exploit witness malleation in compact blocks to delay block processing by up to 10 minutes."

The third vulnerability, categorized as CVE-2025-62860, was a medium-severity issue that impacted network connections. It resulted in thousands of reachable mainnet nodes mistakenly granting whitelist permissions to incoming connections routed through Tor.

Despite the wide reach of the Tor-related bug, its actual threat level was mitigated by user settings. Clarifying that the risk was isolated to specific configurations, Hunt noted, "Nodes without the non-default whitelist setting were not affected."

Deployment of fixes

Network participants have been protected from these issues for an extended period, as developers deployed remedies for all three bugs in late 2025.

Bitcoin Core version 30.0 officially shipped with the comprehensive fixes on October 10, 2025. Just four days later, version 29.2 was released, integrating the identical patches on October 14, 2025.