Bitcoin Core Patches High-Severity Bug That Could Have Stalled Miners

Bitcoin Core has disclosed three now-patched security vulnerabilities in the reference software that operates the majority of Bitcoin network nodes, including one high-severity flaw that could have halted a miner's ability to earn block rewards. The advisories, published in a batch, cover denial-of-service and privacy issues rather than anything enabling coin theft or forgery.

The most serious flaw, tracked as CVE-2025-62861, concerns block template creation — the process miners depend on to assemble new blocks. According to the advisory, a chain reorganization could trigger an erroneous eviction of certain transactions, corrupting a node's mempool, its waiting room for unconfirmed transactions. An affected node could no longer build block templates until it was restarted. For a miner, that means a stop to the very work that produces revenue.

That operational exposure deserves emphasis. A corrupted mempool does not lose coins; it stops a mining operation from participating in consensus until an operator intervenes. The bug sat in the middle of Bitcoin Core's four-tier severity scheme, which runs from "low" to "critical" — and none of the three disclosures reached the critical tier.

What Were the Other Two Flaws?

A second vulnerability, CVE-2025-62859, allowed a peer to stall a node's block processing by announcing a compact block carrying a manipulated witness, a form of transaction malleation. The attack requires only a malicious peer, not hash power or privileged access.

The third, CVE-2025-62860, was a privacy and security defect in which inbound connections over the Tor anonymity network were wrongly granted "whitelist" permissions. That misclassification stripped various denial-of-service and privacy protections from affected nodes. The developers reported no evidence that any of the three flaws was exploited.

The "critical" label matters because Bitcoin Core reserves it for bugs threatening coin theft at the protocol level, unauthorized coin creation, or permanent network-wide chain splits. These flaws do not meet that bar. The absence of observed exploitation, however, is not proof of absence — disclosure follows the fixes, so any window of quiet abuse would be invisible to the public record.

Why the Disclosure Policy Changed?

The disclosures arrive amid a broader reckoning over how quickly Bitcoin's defenders can keep pace with a shifting threat environment. Bitcoin Core recently rewrote its security policy to account for artificial intelligence, adding a category for "easily discoverable" vulnerabilities that a simple AI prompt can surface. The project now patches and discloses that class of bug immediately rather than holding it under a long embargo.

That shift reflects mounting concern that large language models have lowered the cost of finding flaws. A volunteer effort called the "Bitcoin Red Team" has been racing to uncover AI-discoverable bugs across the ecosystem before attackers can exploit them.

The fixes for the three disclosed flaws shipped earlier than the advisories, in line with Bitcoin Core's disclosure timeline. Node operators are urged to run the latest software version to stay protected — an admonition that is only as effective as the fraction of operators who act on it.

The takeaway in plain words: the network's core software carried three exploitable weaknesses, now fixed, and the project's own policy now assumes AI will find the next ones faster than before.