Bitcoin Core developers disclosed details of three previously fixed security vulnerabilities affecting mining-node operations, block processing and the privacy of some Tor users. The developers fixed all three in Bitcoin Core 30.0 and 29.2 in October 2025, addressing flaws that could disrupt mempool operations, delay block processing and weaken protections against distributed denial-of-service attacks.

Mempool flaw could disrupt mining nodes

The most serious vulnerability, CVE-2025-62861, affected Bitcoin Core versions 28.0 through 28.2 and 29.0 through 29.1. Niklas Gögge reported the issue on September 26, 2025.

The flaw involved the sibling eviction mechanism, which sets rules for removing related transactions under the TRUC policy. After a blockchain reorganization, those rules continued to apply to transactions that returned to the mempool.

As a result, a node could remove a parent transaction while leaving its child transactions in the mempool. The resulting inconsistency could prevent miners from producing valid block templates. Affected nodes had to restart the software to restore normal operations.

Compact-block processing could face repeated delays

The second vulnerability, CVE-2025-62859, received a medium-severity rating. Eugene Siegel described the issue in April 2025.

The vulnerability allowed a malicious network peer to manipulate witness data in compact blocks through witness malleation, potentially delaying block processing by as much as 10 minutes.

An attacker could repeat the attack without limit against nodes started with the -blocksonly parameter. The same applied if the attacker controlled all three of a node’s high-bandwidth peers.

Tor configuration could grant privileged access

The third vulnerability, CVE-2025-62860, concerned the handling of incoming Tor connections. Under certain configurations, the proxy server’s IP address could fall within the range specified by the -whitelist setting, giving Tor nodes connected through that proxy privileged access.

The issue could weaken protections against distributed denial-of-service attacks and reduce privacy. According to Bitcoin Core, the relevant configuration affected thousands of reachable nodes on the Bitcoin mainnet. Nodes without the non-standard whitelist configuration were not vulnerable to the issue.

Fixes arrived in October 2025

Bitcoin Core addressed all three vulnerabilities in software updates. Version 30.0 was released on October 10, 2025, followed by version 29.2 on October 14. The final vulnerable software version reached end of life on October 27, 2025.

The disclosures followed earlier information from the Bitcoin Core team about three vulnerabilities identified through automated code scanning by a large language model.

Source: Incrypted