Bitcoin Core Developers have disclosed three critical security vulnerabilities, including one that is highly dangerous and could disrupt the mining capacity of the Bitcoin network, preventing miners from creating new blocks.
According to a security announcement released on November 10th, these vulnerabilities affected multiple Bitcoin core software components that support the world's leading cryptocurrency, which are the software that runs many nodes.
One of the vulnerabilities is named CVE-2025-62861, and it has been rated as high-risk due to its potential impact on Bitcoin miners.
This vulnerability may cause issues after a blockchain reorganization. A blockchain reorganization refers to the process where the network replaces previously accepted blocks with another chain.
More specifically, this issue may lead to inconsistencies in the node's mempool. mempool is used to store all unconfirmed transactions.
This vulnerability affects versions Bitcoin Core 28.0 to 28.2, as well as 29.0 to 29.1.
It was first reported by security researcher Niklas Goegge on September 26, 2025.
Bitcoin security vulnerability disclosed
In addition to this mining-related vulnerability, the developers of Bitcoin Core have also disclosed two other security issues, both of which are rated as moderate in severity.
The first vulnerability ( CVE-2025-62859 ) may be exploited by malicious actors to slow down the processing speed of Bitcoin blocks through techniques that involve transactions witness data.
In some cases, it may cause affected nodes to wait up to 10 minutes before processing a block.
In addition, when a node is running under specific configurations, this type of attack can be repeated indefinitely on that node.
This vulnerability was discovered by Eugene Siegel in April 2025.
The second vulnerability ( CVE-2025-62860 ) involves Bitcoin nodes that operate over an anonymous Tor network.
Bitcoin Core Developers have actually revealed that thousands of accessible Bitcoin mainnet nodes have been granting permissions to incoming Tor connections.
However, this issue does not affect nodes that have not used the optional allowlist configuration.
Keep silent.
These three vulnerabilities are not newly discovered. In fact, the developers of Bitcoin Core had already fixed these issues as early as October 2025.
These fixes have been integrated into versions Bitcoin Core 30.0 and 29.2, with the former being released on October 10th and the latter on October 14th.
That high-risk mining vulnerability has also been fixed in Bitcoin Core 28.3.
Delayed disclosure of these vulnerabilities complies with the security policy of Bitcoin Core. This policy typically requires developers to wait at least two weeks after the last affected software version stops being supported before releasing details of medium to high-risk vulnerabilities.
