The Bitcoin Core development team has disclosed three security vulnerabilities that it says have already been fixed, including a high-severity bug related to mining, Japanese outlet CoinPost reported. According to the outlet, the disclosure was made on 10 November 2026.
The fixes shipped in Bitcoin Core 30.0, released in October 2025, followed by version 29.2, according to the Bitcoin Core team as relayed by CoinPost. The report says the oldest of the three flaws was reported to the team in April 2025 and the other two in September 2025.
CoinPost says the last version affected by the flaws reached end of support on 27 October 2026, so the public disclosure came roughly two weeks later.
The high-severity mining bug
The most serious issue, CVE-2025-62861, affected Bitcoin Core versions 28.0 to 28.2 and 29.0 to 29.1, according to the report. After a chain reorganization, transactions returning to the mempool could be wrongly subjected to a “sibling eviction” under the TRUC rules. A transaction could therefore be evicted while its descendants remained, which could compromise the consistency of the mempool.
The Bitcoin Core team said miners affected by the bug had to restart their node before they could create valid block templates again.
Two medium-severity flaws
CVE-2025-62859 allowed a malicious peer to exploit witness malleability in compact blocks to delay block processing by up to 10 minutes, according to the team. The attack could reportedly be repeated indefinitely against nodes running in -blocksonly mode, or if the attacker controlled all three of the victim’s high-bandwidth peers.
CVE-2025-62860 concerned peers connecting through Tor. If they matched an IP range set with the -whitelist option, they could receive whitelist permissions. Only nodes with -whitelist enabled and an IP range that included a Tor proxy were affected.
According to the Bitcoin Core team, thousands of externally reachable mainnet nodes had whitelisted Tor connections.
Disclosure policy and open questions
CoinPost also notes that Bitcoin Core announced in October a policy of disclosing “easily discoverable vulnerabilities”, meaning those that can be found with simple AI prompts, as early as possible. The source does not make clear whether that October is in 2025 or 2026.
Several points remain unknown. The report does not say whether any of the flaws was exploited in the wild, who found them, or the exact dates of the reports and releases. The article relies on a single secondary source, and the original Bitcoin Core advisory was not among the material reviewed.
Sources
- coinpost.jp CoinPost — ビットコインコア、深刻度の高いバグ含む3件の脆弱性を修正済 Accessed
Comments