Bitcoin (BTC) Core Discloses CVE-2025-62861 Bug That Could Halt Block Building

Bitcoin Core Discloses CVE-2025-62861

Bitcoin (BTC) Core developers disclosed CVE-2025-62861 on November 10, a high-severity flaw that could leave affected nodes unable to build new blocks. The advisory states the bug surfaced during chain reorganizations, routine events in which the network replaces recently added blocks, and corrupted the mempool, a node's holding area for unconfirmed transactions. Versions 28.0 to 28.2 and 29.0 to 29.1 of Bitcoin Core were affected. The project rated the issue high severity because it breaks block production on affected software rather than threatening coins directly. The Bitcoin (BTC) network's consensus rules were never at stake; the defect sat in how a vulnerable node managed its own transaction pool.

At the center of the fault is a rule called sibling eviction, introduced with version 28.0. It governs TRUC transactions (Topologically Restricted Until Confirmation), a newer relay policy that allows only one unconfirmed child per transaction. Under the rule, a second child paying higher fees can replace the first, letting senders outbid a stale payment. That logic misfired when nodes restored transactions from blocks disconnected during a reorganization: a node could drop a restored transaction while keeping its descendants, leaving leftover children that spent funds which no longer existed.

A block template is the candidate block a node prepares for miners to work on. Once the mempool turned inconsistent, template creation failed its validity check, and the node could no longer produce blocks at all. Affected nodes stopped themselves with their own safety checks, which is why the flaw caused stoppage rather than invalid blocks. The only remedy was a restart, which forced the node to rebuild its mempool from scratch. The exposure fell mainly on miners and pool operators, the participants in crypto mining who run full nodes to assemble those templates. For a mining operation, that stoppage means idle hash power until the software is patched or restarted.

Bitcoin (BTC) Core Project's November 10 disclosure post on X

Fix Shipped in October 2025

Security researcher Niklas Goegge reported the flaw responsibly on September 26, 2025, giving maintainers more than a year to ship fixes before any details went public. Developer Greg Sanders submitted the patch in pull request 33504. Patched releases followed in October 2025 with versions 30.0, 29.2, and 28.3, and the project's disclosure post states the fix landed in Bitcoin Core v30.0 on October 10, 2025. Nodes on version 30.0 and the two patched backports are unaffected. The advisory itself was published on November 10, only after the last vulnerable release in the 29.x series reached end of life, meaning the project no longer ships updates for that line. This delay is a coordinated-disclosure practice that lets most nodes upgrade before exploit specifics circulate.

The same disclosure batch carried two more bugs fixed in version 30.0. One could stall block processing outright; the other granted permissions to inbound Tor connections that should not have received them. The November disclosure also follows an October batch of three other bugs, which an AI-powered scanner called Project Loupe flagged. Two batches inside roughly six weeks, six bugs in total, marks a busy stretch for the project's security reviewers.

Operators still running anything from 28.0 through 29.1 should upgrade immediately, and restarting an affected node restores a clean mempool in the meantime. For anyone weighing a fresh deployment, our How to Run a Bitcoin Node guide walks through a clean setup step by step. Core-side work continues beyond these patches: the recently discussed OP_CCV pull request targets stateful contracts on the base layer, and COINOTAG's Bitcoin coverage tracks that thread as it develops.

The practical takeaway is narrower than the severity label suggests. The advisory describes a self-inflicted failure mode, not an observed attack: nothing in the disclosure claims an attacker triggered the mempool corruption, and no chain split or stolen funds are reported. The defensible read is operational. Mining pools on stale software face downtime, a cost in foregone block rewards rather than in lost coins, and the disclosure carries no estimate of how many nodes still run the affected versions. Nothing here touches the Bitcoin price directly; consensus rules stayed intact throughout. What the advisory does not establish is the size of the residual exposed fleet, the number that would make this risk concrete.