Community Trust ScoreVerified
Bitcoin Core developers published security advisories on Nov. 10 revealing three vulnerabilities in the software that powers the Bitcoin network, including a high-severity flaw that could disrupt mining operations, according to U.Today.
Earlier reporting: Bitcoin Short-Term Holders Move $3.6 Billion in BTC to Exchanges at a Loss.
Earlier reporting: Hut 8 Reports $26.6B AI Contract Value, Sells 3,102 Bitcoin for Buybacks.
As of 07:55 UTC, Bitcoin traded at $73,549, -0.4% over 24 hours, with $24.2 billion in 24-hour volume.
The most significant issue, identified as CVE-2025-62861, was rated high-severity due to its potential to prevent miners from creating new blocks. The bug could trigger an inconsistent state in a node’s mempool, the area where unconfirmed transactions are stored, specifically following a blockchain reorganization. In such an event, previously accepted blocks are replaced by the network with an alternative chain.
High-Severity Mining Flaw
The vulnerability affected Bitcoin Core software versions 28.0 through 28.2 and 29.0 through 29.1. Security researcher Niklas Goegge first reported the issue on Sept. 26, 2025. The flaw posed a direct risk to the mining process, which relies on the consistent processing of transaction data to validate new blocks.
Developers noted that the issue was not a new discovery at the time of the advisory but had already been addressed in prior software releases. The patch for this specific high-severity mining vulnerability was included in Bitcoin Core version 28.3.
Medium-Severity Block and Tor Issues
The remaining two vulnerabilities were rated medium-severity. The first, CVE-2025-62859, allowed malicious network participants to slow down Bitcoin block processing. The exploit involved manipulating transaction witness data. Under certain circumstances, this attack could force an affected node to wait for up to 10 minutes before processing a block. Furthermore, the attack could be repeated indefinitely on nodes running in specific configurations. Eugene Siegel discovered this vulnerability in April 2025.
The second medium-severity issue, CVE-2025-62860, concerned Bitcoin nodes operating on the anonymous Tor network. Bitcoin Core developers disclosed that thousands of reachable Bitcoin mainnet nodes had been granting permissions for incoming Tor connections. However, the issue did not impact nodes that did not use the optional whitelist configuration.
Fixes and Disclosure Policy
All three issues were fixed by the Bitcoin Core development team in October 2025. The fixes were integrated into Bitcoin Core 30.0, released on Oct. 10, and Bitcoin Core 29.2, rolled out on Oct. 14. The high-severity mining vulnerability was also patched in Bitcoin Core 28.3.
The delay between the fixes and the public disclosure was consistent with the Bitcoin Core security policy. This policy typically requires developers to wait at least two weeks after the end of life of the last affected software version before publishing details of medium- or high-severity vulnerabilities.
Source: U.Today
