Bitcoin Core discloses three vulnerabilities fixed over a year ago

Bitcoin Core has publicly disclosed three security vulnerabilities that were patched more than a year before the announcement, including a bug that could leave a node unable to produce a valid block template until it was restarted.

The disclosure names the affected software precisely: Bitcoin Core versions 28.0 through 28.2 and 29.0 through 29.1. The block-template bug, reported on September 26, 2025, was triggered by a chain reorganization — the event where nodes drop a few recent blocks in favor of a competing chain. Bitcoin Core describes it as a condition a reorg could set off, not the result of a deliberate attack.

The mechanics matter for mining operators. A block template is the draft block a miner assembles before attempting to mine it. If a node hit the bug, template production halted until a manual restart. For a mining pool, that translates directly into lost hashing time and missed block opportunities.

What did the Tor whitelisting flaw expose?

A second vulnerability, tracked as CVE-2025-62860, concerned Tor connection whitelisting. Bitcoin Core said inbound Tor peers could wrongly inherit trusted permissions from the optional -whitelist setting. That lifted some denial-of-service limits and weakened privacy protections.

The bug only bit operators who used the non-default -whitelist option with an IP range covering their Tor proxy's address — a configuration some software bundles shipped by default. Bitcoin Core said "thousands" of reachable nodes were whitelisting all incoming Tor connections. Nodes running default settings were never affected.

How serious was the compact block bug?

The third flaw, CVE-2025-62859, involved compact block processing. A malicious peer could stall block processing for roughly 10 minutes at a time, and repeat the stall indefinitely under two conditions: if it controlled all three of the victim's high-bandwidth peers, or if the victim ran in -blocksonly mode. That issue was reported in April 2025.

The operational risk here is a delayed view of the chain. A node stalled this way falls behind tip propagation, which matters for miners racing to build on the latest block and for services that need timely confirmation data.

Why is the public only hearing about this now?

All three vulnerabilities were backported and fixed in Bitcoin Core releases from October 2025. Bitcoin Core 30.0 shipped on October 10, 2025 with the fixes already in place.

The disclosure timing follows the end of support for Bitcoin Core 29.x on October 27, 2026 — the last affected version line. By waiting until every vulnerable release had aged out of support, the project closed the window in which publishing details could have armed attackers against unpatched nodes.

The pattern is consistent with Bitcoin Core's standard responsible-disclosure practice: patch first, wait for adoption, then publish. Operators still running 28.x or 29.x builds are now on unsupported software with publicly documented vulnerabilities, and the practical deadline to upgrade is already behind them — October 27, 2026.