Bitcoin Core Discloses Three Patched Vulnerabilities

Bitcoin Core developers on November 10, 2026 published details of three vulnerabilities in the client. All were fixed in 2025; one of them, CVE-2025⁠–⁠62861, is rated high severity because it could stop a miner from building a valid block template.

Details

CVE-2025⁠–⁠62861 concerns the mempool rules for version 3 (TRUC) transactions. After a chain reorganization, transactions from disconnected blocks are re-added to the mempool, but the "sibling eviction" logic still ran when it should have been bypassed. That could leave the mempool inconsistent, and a miner could not create a valid block template until the node was restarted. Versions 28.0⁠–⁠28.2 and 29.0⁠–⁠29.1 are affected; the fix shipped on October 10, 2025 in version 30.0.

The other two are medium severity. CVE-2025⁠–⁠62859: according to The Block, a malicious peer could abuse witness malleation in compact blocks to delay block processing by up to 10 minutes. CVE-2025⁠–⁠62860: Tor peers could be granted whitelist permissions when a proxy address fell inside a configured range, bypassing DoS limits on nodes using the -whitelist option.

What this means for the market

Details are published only after patched releases have spread. Anyone running a node or mining should make sure they are on a current version. The disclosures do not describe any effect on network consensus or user funds. For the recent change in disclosure policy, see our earlier report. For the live bitcoin price, see the daily brief.