Bitcoin Core Discloses Three Flaws Affecting Block Creation, Tor Peers, and Compact Blocks
Do Son 
TL;DR
The Bitcoin Core team disclosed three patched Bitcoin Core vulnerabilities that affect block templates, Tor peer rules, and compact block sync. Tracked as CVE-2025-62861, CVE-2025-62860, and CVE-2025-62859, the bugs can halt mining nodes, expose Tor hosts, or stall block sync. Node operators on older builds must update to versions 30.0, 29.2, or 28.3 right away.
Why It Matters
Bitcoin Core serves as the main software tool for checking transactions and mining blocks on the Bitcoin network. Therefore, bugs in mempool rules or peer handling put both miners and public routing nodes at high risk.
Currently, devs confirm that no active attacks in the wild or public exploit tools exist for these bugs. However, the Tor whitelist bug alone exposed a large part of the network. As the project noted, “This led to thousands of reachable mainnet nodes whitelisting all incoming Tor connections.”
How the Attack Works
Halted Block Creation on Chain Reorgs (CVE-2025-62861)
First, the CVE-2025-62861 high-severity advisory details a mempool bug caused by version 3 (TRUC) transaction rules during a chain reorg. When a node drops blocks during a reorg, it puts those transactions back into the mempool with bypass_limits set to true. As the report notes, “The bug was that the sibling-eviction branch was not gated on bypass_limits, so TRUC enforcement still ran while transactions were being re-added.”
Consequently, the node could evict a parent transaction while leaving its child transactions in the mempool. Because those children spent missing outputs, block template creation failed until the operator restarted the mining node.
Tor Whitelisting and Compact Block Stalls
Second, the CVE-2025-62860 medium-severity advisory covers a flaw in the -whitelist option. Inbound Tor peers share the local IP address of the Tor daemon. Thus, nodes with a local IP range whitelist gave trusted rights to all incoming Tor peers. As the report warns, “The -whitelist configuration lifts various DoS limits and privacy leak mitigations for trusted peers.”
Third, the CVE-2025-62859 medium-severity advisory involves witness malleation in compact blocks. Affected nodes cleared their download state for a compact block before checking for witness malleation. If a bad peer announced a mutated block first, the victim node fell back to a 10-minute GETDATA timeout. An attacker controlling three high-bandwidth peers or hitting a -blocksonly node could repeat this stall forever.
Affected Versions
These Bitcoin Core vulnerabilities hit versions before 30.0 and 29.2. Specifically, CVE-2025-62861 affects versions 28.0 to 28.2 and 29.0 to 29.1. Meanwhile, CVE-2025-62860 impacts all builds before 28.3, 29.2, and 30.0 that use the -whitelist setting.
Patch and Mitigation Steps
Devs fixed all three bugs across Bitcoin Core versions 30.0, 29.2, and 28.3. Specifically, pull request 33504 gated TRUC checks on bypass_limits, and new builds never whitelist inbound Tor onion peers. Node operators and miners should update to version 30.0, 29.2, or 28.3 right away. If admins cannot patch CVE-2025-62860 now, they should remove local Tor proxy IPs from their -whitelist settings.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
