Bitcoin Core disclosed three security vulnerabilities on Nov. 10, 2026, fixing flaws that shipped in version 30.0 on Oct. 10, 2025. The project held back the details until release line 29.x reached end of life on Oct. 27, 2026. By Unchained’s count, 396 days separated the initial fix from public disclosure. One bug, CVE-2025-62861, is rated High severity, while CVE-2025-62860 and CVE-2025-62859 are rated Medium. The advisories do not say whether any bug was exploited in the wild. These disclosures are separate from three AI-found bugs revealed without an embargo on Oct. 28.
A Mining Node That Can’t Build Blocks
The High-rated bug sat in the mempool, each node’s pool of unconfirmed transactions. It involved TRUC version 3 transactions, which are limited to one unconfirmed parent and one unconfirmed child. Version 28.0 added a "sibling eviction" rule that drops an existing child for a better-paying one. That rule kept firing during a chain reorganization, when a node swaps recent blocks for a competing chain and returns their transactions to the mempool. It could remove a restored transaction while keeping those spending it. Per the advisory, the miner’s block template then fails validation, so the node "cannot produce blocks until it is restarted." Versions 28.0 to 28.2 and 29.0 to 29.1 were affected. Niklas Goegge reported it in September 2025. This failure mode clearly halts mining operations entirely, forcing operators to restart nodes manually.
Tor Peers Treated as Trusted
The second bug only hit nodes using the optional -whitelist setting, which relaxes denial-of-service limits and privacy protections for trusted peers. Inbound Tor connections carry the local Tor daemon’s address, so whitelisting a range covering that daemon gave every Tor peer the same permissions. Vendors bundling Bitcoin Core with Tor set it that way, which the project said led to "thousands of reachable mainnet nodes whitelisting all incoming Tor connections." Martin Zumsande and Antoine Poinsot reported it, and Poinsot alerted Bitcoin Knots maintainer Luke Dashjr and several affected providers in September 2025. The third bug let a malicious peer stall a node’s block processing by abusing its handling of compact blocks, a bandwidth-saving way of relaying new blocks. In some setups the stall could repeat indefinitely. Eugene Siegel reported it in April 2025. Versions 29.2 and 30.0 are the first releases fixing all three, per the advisories’ timelines.
