Bitcoin Core Discloses Three Patched Network Flaws

High Severity Mining Flaw Disclosed

Bitcoin Core maintainers disclosed three previously patched security vulnerabilities on Nov. 10, highlighting a high-severity bug capable of disrupting network mining operations. Security advisories detail that the primary vulnerability, cataloged as CVE-2025-62861, threatened miners by corrupting mempool consistency following blockchain reorganizations. The software flaw impacted Bitcoin Core versions 28.0 through 28.2 and versions 29.0 through 29.1.

Independent security researcher Niklas Goegge reported the high-severity vulnerability to project maintainers on Sept. 26. The bug carried risks of stalling block creation across affected nodes. Maintainers deployed patches before making the advisory public.

Additional Medium Severity Vector Patches

Project disclosures outlined two additional medium-severity issues affecting transaction processing and network routing configurations. Security researcher Eugene Siegel identified the first flaw, tracked as CVE-2025-62859, in April. The vulnerability allowed malicious actors to delay block processing by up to 10 minutes through manipulated transaction witness data.

A second medium-severity issue, tracked as CVE-2025-62860, exposed thousands of mainnet nodes operating on the Tor network to unauthorized incoming connections. The issue surfaced specifically on nodes utilizing optional whitelist configurations. Node operators faced exposure risks until repository updates were applied.

Remediation Timelines and Software Releases

Project maintainers integrated all necessary fixes into Bitcoin Core version 30.0 on Oct. 10 and version 29.2 on Oct. 14. The high-severity mining vulnerability also received a dedicated backport patch in version 28.3. Disclosure timing adhered strictly to project security policies requiring waiting periods following the end-of-life cycle of affected software branches.

Code repositories reflect active deployment of the updated software packages across major node operators. Network disruption risks were mitigated prior to public disclosure. No active exploitation data accompanied the release.

Automated Threat Vectors and Accelerated Disclosure Protocols

This development follows an established trajectory that gained operational urgency on Oct. 29, 2026, when Bitcoin Core released versions 29 through 32 to patch three node-crashing bugs identified by the AI security tool Project Loupe. That incident forced the development team to shorten standard vulnerability disclosure windows from one full year down to a single week.

By accelerating patch deployment cycles to counter automated exploit threats driven by artificial intelligence, project maintainers established a responsive framework that directly informs how subsequent network vulnerabilities, including the mempool and Tor routing flaws disclosed in recent advisories, are managed and remediated across active software branches.