Bitcoin Core discloses three fixed security vulnerabilities, including a high-severity flaw that could prevent miners from generating block templates.

Bitcoin Core has publicly disclosed three previously patched security vulnerabilities, one rated high-severity. The high-severity flaw, CVE-2025-62861, impacts versions 28.0 through 28.2 and 29.0 through 29.1. During chain reorganization, the "evict siblings" rule for version 3 transactions is incorrectly enforced, potentially removing a transaction from the mempool while retaining its descendants, leading to inconsistent mempool state. Affected miner nodes cannot generate valid block templates and require a restart to resume block production. The issue was discovered and responsibly disclosed by Niklas Goegge in September 2025. The other two vulnerabilities are medium-severity. CVE-2025-62859, reported by Eugene Siegel, allows malicious nodes to exploit segwit malleability in compact blocks to delay a peer’s block processing by up to roughly 10 minutes. This attack can be repeated if the attacker controls all three of the peer’s high-bandwidth peers, or if the peer operates in -blocksonly mode. CVE-2025-62860 affects nodes with non-default -whitelist settings where the whitelisted range covers Tor proxy addresses. Incoming Tor connections may be incorrectly granted whitelist privileges, weakening some denial-of-service (DoS) protections and privacy safeguards. Bitcoin Core noted that thousands of accessible mainnet nodes had this setting open to incoming Tor connections; nodes without the configuration enabled are not impacted. Patches for the vulnerabilities were rolled out in releases including 30.0 (published October 10, 2025), 29.2 (October 14, 2025), and the subsequent 28.3. The last affected version reached end-of-life on October 27 this year.