A Bitcoin Core bug could leave a mining node unable to produce blocks after a chain reorganization, according to the project’s Nov. 10, 2026, security disclosure.
The most serious issue, CVE-2025-62861, involved how the software restored version 3 transactions to its mempool after a chain reorganization. The transaction pool could retain transactions that depended on another transaction even after that transaction had been removed. In that state, the node could fail to create a valid block template and remain unable to produce blocks until restarted.
The bug affected Bitcoin Core versions 28.0 through 28.2 and 29.0 through 29.1. The project fixed it in versions 28.3, 29.2 and 30.0.
A separate medium-severity issue, CVE-2025-62859, involved a malicious peer sending a compact-block announcement with altered witness data, which could interrupt a node's handling of blocks. The stall could continue indefinitely if the attacker controlled every one of the node's three high-bandwidth peers, or if the node ran with -blocksonly. EconoTimes previously explained the block-processing flaw.
CVE-2025-62860 affected some incoming Tor connections when an operator's configured address range also covered the Tor proxy. Those connections could receive whitelist permissions. Bitcoin Core said the nondefault -whitelist option can exempt matching connections from some denial-of-service controls and privacy safeguards. The project reported that thousands of reachable mainnet nodes had incoming Tor connections on the whitelist; nodes without the option were unaffected.
The advisories came out 14 days after the Bitcoin Core 29.x release line reached end of life on Oct. 27, 2026. The project's policy calls for medium- and high-severity vulnerabilities to be disclosed two weeks after support ends for the final affected release line, unless they are classified as easily discoverable.
