Bitcoin Core publicly disclosed a high-severity vulnerability, tracked as CVE-2025-62861, on 10 November 2026, according to a report by Chinese-language outlet PANews citing the disclosure. The flaw reportedly can leave a node’s transaction pool in an inconsistent state and prevent affected nodes from producing blocks until they are restarted.
What the flaw does
As PANews describes it, the problem lies in the logic for TRUC sibling eviction. During a chain reorganization, that logic is reportedly not restricted by the bypass_limits setting. When transactions are re-added to the mempool, a restored transaction can be evicted while its descendants remain in the pool.
That inconsistent state can reportedly cause the creation of a block template to fail. In practice, according to the report, an affected node would not be able to produce blocks until it is restarted.
Affected versions and fix
PANews lists the affected versions as 28.0 to 28.2 and 29.0 to 29.1. According to the report, the fix was released in Bitcoin Core v30.0 on 10 October 2025 and backported to the 28.x and 29.x branches. The fix pull request is reported as #33504, submitted by Greg Sanders.
The report says the vulnerability was discovered and responsibly disclosed by Niklas Goegge.
Timing of the disclosure
According to PANews, details were made public only after the last affected branch, 29.x, reached end of support on 27 October 2026. This sequence, a fix first and details later, is consistent with the responsible disclosure the report attributes to the discoverer.
What remains unknown
Several points are unclear. The report does not say whether the flaw was exploited on the network, nor how many nodes or miners were affected. It also does not specify which version numbers of the patched 28.x and 29.x releases contain the fix. The original Bitcoin Core advisory was not among the material reviewed, and the account rests on a single outlet, so the details could not be independently verified here.
Sources
- panewslab.com PANews — Bitcoin Core披露高危漏洞：重组期间TRUC规则可致节点无法出块，已完成修复 Accessed
Comments