Bitcoin Core discloses three fixed security vulnerabilities, including a high-severity issue that could prevent miners from generating block templates.

November 11 — Bitcoin Core publicly disclosed three previously fixed security vulnerabilities, one of which was rated high severity. The vulnerability designated CVE-2025-62861 affects versions 28.0 through 28.2 and 29.0 through 29.1. During chain reorganization, the "sibling eviction" rule for version 3 transactions is still incorrectly enforced, potentially evicting a transaction from the mempool while leaving its descendants behind, resulting in an inconsistent mempool state. Affected mining nodes will be unable to generate valid block templates and must restart the node before block production can resume. The issue was discovered and responsibly disclosed by Niklas Goegge in September 2025.

The other two are medium-severity vulnerabilities. CVE-2025-62859 was reported by Eugene Siegel; a malicious node can exploit segregated witness malleability in compact blocks to delay the counterparty's block processing by up to approximately 10 minutes. If the attacker controls all three of the counterparty's high-bandwidth peers, or the counterparty runs in -blocksonly mode, this disruption can be repeated. CVE-2025-62860 affects nodes that have enabled the non-default -whitelist setting and whose whitelisted network ranges cover Tor proxy addresses; incoming Tor connections may be incorrectly granted whitelist permissions, thereby relaxing some denial-of-service limits and privacy protections. Bitcoin Core stated that at the time, thousands of reachable mainnet nodes had thus opened whitelist access to incoming Tor connections; nodes that did not enable this setting were unaffected. Fixes for the above vulnerabilities were released with version 30.0 on October 10, 2025, version 29.2 on October 14, and the subsequently released version 28.3; the last affected version reached end of life on October 27 of this year.