Key facts
- CVE-2025-62861 could corrupt a node's mempool during a chain reorganization, halting block template creation until restart.
- CVE-2025-62859 could let a peer stall a node's block processing by announcing a compact block with a manipulated witness.
- CVE-2025-62860 wrongly granted Tor inbound connections whitelist permissions, lifting denial-of-service and privacy protections.
- Bitcoin Core said it found no evidence the three flaws were exploited.
- Bitcoin Core rewrote its security policy to add an easily discoverable category for bugs surfaced by a simple AI prompt.
Bitcoin Core developers disclosed three security vulnerabilities in the software that runs most of the Bitcoin network, all of which have since been fixed, according to a batch of security advisories. The flaws span denial-of-service and privacy issues rather than anything that would let an attacker steal coins or forge Bitcoin. Bitcoin Core classifies vulnerabilities into four tiers, from low to critical, and these fell into the middle of that range.
The most serious, tracked as CVE-2025-62861, concerns block template creation, the process miners use to assemble new blocks. According to the advisory, a chain reorganization could trigger an erroneous eviction of certain transactions, corrupting a node's mempool, its waiting room for unconfirmed transactions, so that an affected node could no longer build block templates until restarted. For a miner, that means a halt to the work that earns block rewards.
A second flaw, CVE-2025-62859, could let a peer stall a node's block processing by announcing a compact block with a manipulated witness, a form of transaction malleation. The third, CVE-2025-62860, was a privacy and security issue in which inbound connections over the Tor anonymity network were wrongly granted whitelist permissions, lifting denial-of-service and privacy protections on affected nodes.
None of the three rises to the critical level Bitcoin Core reserves for bugs that threaten coin theft at the protocol level, unauthorized coin creation or permanent network-wide chain splits. The developers did not report any evidence the flaws were exploited. The fixes shipped earlier, with the advisories following under Bitcoin Core's disclosure timeline, and node operators are generally urged to run the latest software.
Bitcoin Core recently rewrote its security policy to account for AI, adding a category for easily discoverable vulnerabilities that can be surfaced through a simple AI prompt, which it now patches and discloses immediately rather than holding under a long embargo. The report said that shift reflects concern that large language models have lowered the bar for finding flaws, and cited the volunteer Bitcoin Red Team, which it said has been racing to uncover AI-discoverable bugs across the ecosystem before attackers can exploit them.