Bitcoin Core discloses three fixed security vulnerabilities, including a high-severity issue that could prevent miners from generating block templates.

BlockBeats news, November 11 - Bitcoin Core publicly disclosed three previously fixed security vulnerabilities, one of which was rated as high severity. The vulnerability numbered CVE-2025-62861 affects versions 28.0 to 28.2 and 29.0 to 29.1. During chain reorganization, the "sibling eviction" rule for version 3 transactions is still incorrectly enforced, potentially evicting a transaction from the mempool while leaving its descendants behind, resulting in an inconsistent mempool state. Affected mining nodes will be unable to generate valid block templates and will need to restart their nodes before resuming block production. The issue was discovered and responsibly disclosed by Niklas Goegge in September 2025.

The other two are medium-severity vulnerabilities. CVE-2025-62859 was reported by Eugene Siegel, where a malicious node can exploit segregated witness malleability in compact blocks to delay the counterparty's block processing by up to approximately 10 minutes. If an attacker controls all three of the counterparty's high-bandwidth peers, or if the counterparty runs in -blocksonly mode, this disruption can be carried out repeatedly. CVE-2025-62860 affects nodes that have enabled the non-default -whitelist setting with whitelisted network ranges covering Tor proxy addresses, where incoming Tor connections may be incorrectly granted whitelist permissions, thereby relaxing certain denial-of-service restrictions and privacy protections.

Bitcoin Core stated that at the time, thousands of reachable mainnet nodes had thus opened whitelist access to incoming Tor connections, while nodes that had not enabled this setting were unaffected. Fixes for the above vulnerabilities were respectively released with version 30.0 on October 10, 2025, version 29.2 on October 14, and the subsequently released version 28.3, with the last affected version having reached end of life on October 27 of this year.