Bitcoin Core Discloses High-Severity Vulnerability: TRUC Rules During Reorgs Could Block Nodes From Producing Blocks, Fix Already Released

November 11: Bitcoin Core publicly disclosed high-severity vulnerability CVE-2025-62861 on November 10, 2026. The flaw stems from TRUC "sibling transaction eviction" logic not being constrained by bypass_limits during chain reorganizations, which may cause transactions that were restored to be evicted while their descendants are left behind when transactions are re-added, leading to inconsistent mempool state and failure of miners' block template creation, with affected nodes unable to produce blocks until restarted.

Affected versions are 28.0 to 28.2 and 29.0 to 29.1. The fix was released on October 10, 2025 in v30.0 and backported to the 28.x and 29.x branches.

The vulnerability was discovered and responsibly disclosed by Niklas Goegge, and Greg Sanders submitted the fix as PR #33504. The last affected version, 29.x, reached end of support on October 27, 2026, with details publicly disclosed thereafter.