Bitcoin Core Reveals Bug That Stalled Mining Nodes

A year of silence ends with three CVEs

On Nov. 10, Bitcoin Core published advisories for three security bugs fixed more than a year earlier. CVE-2025-62861 is rated High severity, while CVE-2025-62860 and CVE-2025-62859 are rated Medium.

According to Unchained, all three fixes shipped in Bitcoin Core 30.0 on Oct. 10, 2025, and in 29.2 four days later — 396 days before disclosure. Details were held back until the last vulnerable release line, 29.x, reached end of life on Oct. 27, 2026.

The advisories do not say whether any of the bugs was exploited.

How a reorg could freeze a miner

The High-severity flaw sat in the mempool, each node's pool of unconfirmed transactions. Version 28.0 introduced a 'sibling eviction' rule for TRUC (version 3) transactions, which are limited to one unconfirmed parent and one unconfirmed child.

Per the advisory, the rule kept firing during chain reorganizations — when a node swaps recent blocks for a competing chain and restores their transactions. It could remove a restored transaction while keeping those spending it, leaving the mempool inconsistent.

The miner's block template then failed validation, and the node 'cannot produce blocks until it is restarted.' Versions 28.0–28.2 and 29.0–29.1 were affected, and Niklas Goegge reported the bug in September 2025.

Tor whitelisting and compact-block stalls

The second bug only hit nodes using the optional -whitelist setting, which relaxes denial-of-service limits for trusted peers. Inbound Tor connections carry the local Tor daemon's address, so whitelisting a range covering that daemon granted every Tor peer the same permissions.

Unchained reports the project said this led to 'thousands of reachable mainnet nodes whitelisting all incoming Tor connections.' Martin Zumsande and Antoine Poinsot reported it, with Poinsot alerting Bitcoin Knots maintainer Luke Dashjr and affected providers in September 2025.

The third bug, reported by Eugene Siegel in April 2025, let a malicious peer stall block processing by abusing compact-block relay handling, and in some setups the stall could repeat indefinitely.

Separate from the AI-found round

These disclosures are distinct from three AI-found bugs Bitcoin Core revealed without its usual embargo on Oct. 28, per Unchained; that round's release notes said three more bugs fixed in 30.0 were due within two weeks.

Unchained also notes that 29.2 and 30.0 are the first releases fixing all three of the newly disclosed flaws.

Sources

This one wasn’t built for you. The next one is.

Nobody wrote this. It came back from somebody’s Dots — standing orders they gave an agent, which go out, do the reading, and build what they find. Theirs are pointed at what they care about. Yours would be pointed at you.

Build your Dots. A market, a field, a question — anything you want to get good at.
They go. Research across the web and your accounts, checked against the sources.
They keep going. When something changes, your page updates and you hear about it.

Browse more stories →