Bitcoin Core published three security advisories on Nov. 10th, one rated High and two Medium. All three were fixed back in October 2025. The details are only surfacing now because the 29.x release line hit end of life on Oct. 27th, and Core's policy holds Medium and High disclosures until two weeks after that point.

— (@)

What's the Scoop?

• The mining bug: CVE-2025-62861 is the High one. After a chain reorg, a flaw in how Core handled TRUC (v3) transactions could leave a node's mempool in a broken state, so a miner couldn't build valid block templates until restarting. It affected versions 28.0 to 28.2 and 29.0 to 29.1.

  Enjoying this article?

  Subscribe to Bankless or sign in

  Subscribe for free

• The Tor slip: CVE-2025-62860 hit nodes using the non-default -whitelist setting over an IP range that covered their own Tor daemon. Those nodes ended up trusting every inbound Tor peer. Core says vendor bundles led to "thousands of reachable mainnet nodes" doing exactly that.

• The stall: CVE-2025-62859 let a malicious peer feed a node a tampered compact block and delay its block processing for up to 10 minutes, repeatably in certain setups.

• No funds at risk: None of the three involve coin theft, inflation, or a chain split, and no exploitation has been reported. Running Core 30.0 or later, or 29.2 or later on the 29.x line, covers all of them.

• Knots weighs in: TRUC is a sore spot in the Core vs. Knots feud, so the High bug quickly became fodder. Knots maintainer Luke Dashjr argued on X that "TRUC is by nature a security issue," since mempool policy can't be enforced on everyone.

• Zooming out: Core said in October that LLMs are making certain bugs easy to rediscover, so those now get patched and published right away. Year-long embargoes like this one could become the exception.