Bitcoin Core Addresses Three Security Vulnerabilities, Including High-Severity Bug Affecting Mining

Bitcoin Core developers have successfully patched three security vulnerabilities in the software, including a high-severity bug that could have disrupted mining operations. The fixes were deployed earlier, with advisories detailing the vulnerabilities released subsequently, adhering to Bitcoin Core’s established disclosure timeline.

According to the advisory, the vulnerabilities primarily involved denial-of-service and privacy concerns. Crucially, none of the flaws posed risks of coin theft or unauthorized creation. Bitcoin Core did not classify any of these three vulnerabilities as ‘critical,’ a designation reserved for bugs that threaten coin theft at the protocol level, unauthorized coin creation, or permanent network-wide chain splits.

The most significant vulnerability, identified as CVE-2025-62861, directly impacted block template creation, a critical process for miners assembling new blocks. A chain reorganization could have triggered an erroneous eviction of certain transactions, potentially corrupting a node’s mempool. This corruption could prevent the affected node from building block templates until it was restarted, effectively halting a miner’s work and their ability to earn block rewards.

A second flaw, CVE-2025-62859, could have allowed a peer to stall a node’s block processing by announcing a compact block with a manipulated witness, a form of transaction malleation. The third vulnerability, CVE-2025-62860, related to inbound connections over the Tor anonymity network. These connections were mistakenly granted “whitelist” permissions, which inadvertently lifted various denial-of-service and privacy protections on affected nodes.

These fixes occur against the backdrop of Bitcoin Core’s recently updated security policy, which now accounts for Artificial Intelligence (AI). The revised policy introduces a category for “easily discoverable” vulnerabilities that can be surfaced through AI prompts. Such vulnerabilities are now patched and disclosed immediately, deviating from previous longer embargo periods. This adjustment reflects a growing concern that large language models may lower the barrier for discovering software flaws.

In parallel, the volunteer “Bitcoin Red Team” is actively working to uncover AI-discoverable bugs across the ecosystem to preemptively address them. Node operators are consistently urged to run the latest software to remain protected against known vulnerabilities.

Bitcoin Core categorizes vulnerabilities into four tiers: low, medium, high, and critical. The vulnerabilities disclosed in this instance fell into the middle of that range. Developers have not reported any evidence that these flaws were exploited before they were fixed.

Why This Matters

The materials describe a narrow update: Three security vulnerabilities in Bitcoin Core software, including a high-severity bug (CVE-2025-62861) affecting block template creation for miners, a flaw (CVE-2025-62859) allowing peers to stall block processing, and a privacy/security issue (CVE-2025-62860) with Tor connections, have been fixed. The exact timeline of when the vulnerabilities were introduced or discovered.

Broader Context

Source materials place the factual news in this context: Bitcoin Core classifies vulnerabilities into four tiers: low, medium, high, and critical.