Bitcoin Core Discloses Three Previously Patched Security Vulnerabilities

Bitcoin Core developers have disclosed details of three security vulnerabilities affecting older versions of the software used to operate Bitcoin nodes. One was classified as high severity because it could prevent affected mining nodes from creating valid block templates under certain conditions.

The advisories were published on November 10, 2026, but the vulnerabilities themselves are not new. They were discovered in 2025, and fixes were released more than a year before the public disclosures.

That distinction matters. The announcement does not mean Bitcoin has just been hacked or that a new attack is underway. Instead, it provides details about previously addressed software weaknesses and highlights the importance of keeping Bitcoin nodes updated.

Three Bitcoin Core Vulnerabilities Explained

The three vulnerabilities involve different parts of Bitcoin Core, from mining operations to block processing and network connections.

According to the official security advisories, one issue was rated high severity, while the other two received medium-severity classifications.

Vulnerability	Severity	Potential Impact
CVE-2025-62861	High	Prevents affected mining nodes from creating valid block templates after certain blockchain reorganizations
CVE-2025-62859	Medium	Allows a malicious network peer to delay block processing
CVE-2025-62860	Medium	Incorrectly grants trusted permissions to incoming Tor connections under specific configurations

The fixes were introduced in Bitcoin Core 30.0 on October 10, 2025, and version 29.2 on October 14, 2025.

Versions 28.3 and later in the 28.x series also received fixes for CVE-2025-62861 and CVE-2025-62860. However, that older branch did not receive the fix for CVE-2025-62859.

High-Severity Bug Could Interrupt Bitcoin Mining

The most serious issue, CVE-2025-62861, involves how Bitcoin Core handles transactions following a blockchain reorganization, commonly called a chain reorg.

A chain reorganization happens when a Bitcoin node switches to a different valid chain of blocks with more accumulated proof-of-work.

When this occurs, transactions from disconnected blocks may need to return to the mempool, where unconfirmed transactions wait to be included in new blocks.

The vulnerability involved Bitcoin Core’s handling of certain transaction rules during that process.

Under specific circumstances, the software could leave the mempool in an inconsistent state. For mining nodes using affected versions, this could prevent the creation of valid block templates until the node was restarted.

A block template is the collection of transactions and related data a miner prepares before attempting to mine a new Bitcoin block.

The issue affected Bitcoin Core versions 28.0 through 28.2 and 29.0 through 29.1.

Security researcher Niklas Goegge reported the vulnerability on September 26, 2025. Developers subsequently corrected the transaction-handling logic.

Although classified as high severity, the problem did not automatically stop mining across the entire Bitcoin network. Its impact was limited to affected software installations experiencing the conditions needed to trigger the bug.

Two Other Issues Affected Block Processing and Tor Connections

The second vulnerability, CVE-2025-62859, involved the way Bitcoin Core processes compact blocks received from other nodes.

Compact blocks are designed to make block propagation more efficient by reducing the amount of information nodes need to exchange.

However, a malicious peer could exploit a flaw involving modified transaction witness data to make a node wait up to 10 minutes before continuing to retrieve a block.

Under certain network configurations, an attacker could repeatedly trigger the delay.

The problem was reported by security researcher Eugene Siegel on April 28, 2025, and fixed in Bitcoin Core 29.2 and 30.0.

The third vulnerability, CVE-2025-62860, concerned connections made through Tor, a network commonly used to improve online privacy.

Bitcoin Core allows operators to designate certain network peers as trusted using an optional setting called -whitelist.

The flaw meant incoming Tor connections could mistakenly receive those trusted permissions when the Tor proxy’s IP address matched a configured whitelist range.

As a result, some protections against denial-of-service attacks and unintended information disclosure could be bypassed.

Bitcoin Core’s advisory noted that thousands of reachable nodes on the Bitcoin mainnet had configurations that granted these permissions to incoming Tor connections.

Importantly, nodes that did not use the affected non-default whitelist configuration were not exposed to this particular issue.

The vulnerability was reported by Martin Zumsande and Antoine Poinsot in September 2025 and patched in subsequent maintenance releases.

Why Were the Vulnerabilities Disclosed in November 2026?

The timing may seem unusual. Why would developers publish details of security issues more than a year after fixing them?

The answer lies in Bitcoin Core’s vulnerability disclosure policy.

For certain security issues, developers delay the release of detailed technical information until affected software versions are no longer supported.

The idea is to give node operators time to install security updates before publishing information that could help attackers exploit the flaws.

Under the project’s policy, medium- and high-severity vulnerabilities are generally disclosed two weeks after the last affected release reaches its end of life.

In this case, the Bitcoin Core 29.x branch reached end-of-life status on October 27, 2026. The three advisories followed on November 10.

This approach is commonly known as coordinated vulnerability disclosure.

Rather than immediately publishing every technical detail, developers coordinate the reporting, development of fixes, and eventual public disclosure.

What Does This Mean for Bitcoin Users?

For people who simply hold or transfer Bitcoin using a wallet, the announcement does not indicate that their balances or private keys have been compromised.

The disclosed vulnerabilities primarily concern Bitcoin Core’s internal operations, including mining, block propagation, and peer connection permissions.

The official advisories also do not establish that these flaws resulted in cryptocurrency theft.

For node operators, however, the disclosures are a useful reminder to review the software versions they are running.

Bitcoin Core versions 29.x and older have reached the end of their maintenance periods. Operators should use a currently supported release containing the relevant security fixes.

As of November 2026, Bitcoin Core 32.1 is available, alongside maintained releases in the 30.x and 31.x branches.

Keeping node software updated helps reduce exposure to known vulnerabilities, although updates alone cannot eliminate every security risk.

The broader lesson is straightforward: Bitcoin’s security depends not only on cryptography and network consensus rules, but also on the reliability of the software used by its participants.

Regular testing, responsible vulnerability reporting, and timely updates remain important parts of maintaining that infrastructure.

Understanding Bitcoin Core, Nodes, and CVEs

A few technical terms help put these disclosures into perspective.

Bitcoin Core is open-source software that allows users to operate a Bitcoin node, validate transactions, and independently enforce the network’s consensus rules.

A Bitcoin node is a computer running software that participates in the Bitcoin network. A full node independently verifies blocks and transactions rather than relying entirely on another service.

Mempool, short for memory pool, refers to the collection of unconfirmed transactions a node keeps while waiting for them to be included in blocks.

CVE (Common Vulnerabilities and Exposures) is a system for identifying publicly known security vulnerabilities. Each CVE receives a unique identifier so researchers, developers, and software users can track the same issue.

One final distinction is worth remembering: Bitcoin Core is a major software implementation used on the Bitcoin network, but it is not the network itself.

Finding a vulnerability in Bitcoin Core does not necessarily mean Bitcoin’s underlying protocol has been compromised.