Bitcoin Core developers have revealed three key security vulnerabilities, including a high-severity flaw that could potentially disrupt the mining capabilities of the Bitcoin network, preventing miners from creating new blocks.
As revealed in security advisories published on Nov. 10, the vulnerabilities impacted various elements of the Bitcoin Core software that powers many nodes underpinning the world’s leading cryptocurrency.
One of the vulnerabilities, titled CVE-2025-62861, was rated as a high-severity issue due to its potential effect on Bitcoin miners.
The bug has the potential to create problems after a blockchain reorganization, which is when previously accepted blocks are replaced by the network with an alternative chain.
More precisely, the issue could cause an inconsistent state in the node’s mempool, where all unconfirmed transactions are stored.
The vulnerability impacted Bitcoin Core software versions 28.0-28.2 and 29.0-29.1.
It was first reported on Sept. 26, 2025, by security researcher Niklas Goegge.
Bitcoin security flaws revealed
Beyond the mining vulnerability, Bitcoin Core developers have announced two further security problems, rated medium severity.
The first one (CVE-2025-62859) could enable malicious network participants to slow down Bitcoin block processing through an exploit that involves changes in transaction witness data.
Under some circumstances, it could make an affected node wait for up to 10 minutes before processing a block.
Moreover, such an attack could be repeated indefinitely on the node when the latter is running in specific configurations.
The vulnerability was found by Eugene Siegel in April 2025.
The second vulnerability (CVE-2025-62860) involved Bitcoin nodes that operate on the anonymous Tor network.
In fact, the Bitcoin Core developers revealed that thousands of reachable Bitcoin mainnet nodes had been granting permissions for incoming Tor connections.
Nevertheless, the issue did not affect nodes that do not use the optional whitelist configuration.
Keeping quiet
The three vulnerabilities are not new discoveries.
In fact, all of the issues were already fixed by the Bitcoin Core developers in October 2025.
The fixes were integrated into both Bitcoin Core 30.0, which was released on Oct. 10, and Bitcoin Core 29.2, rolled out on Oct. 14.
The high-severity mining vulnerability was also patched in Bitcoin Core 28.3.
The delay in the disclosure of the vulnerabilities was in line with the Bitcoin Core security policy, which usually calls for developers to wait at least two weeks after the end of life of the last affected software version before publishing details of medium- or high-severity vulnerabilities.
