Bitcoin Core patches three flaws affecting mining and Tor peers

The Bitcoin Core team has disclosed three patched vulnerabilities that could affect block creation, Tor peer handling and compact block syncing. The weaknesses are tracked as CVE-2025-62861, CVE-2025-62860 and CVE-2025-62859. The disclosures warn that affected nodes on older builds could halt mining, expose Tor hosts or stall block synchronization. The advisories state that fixes have been applied across Bitcoin Core versions 30.0, 29.2 and 28.3, and operators should update promptly to those releases.

The report from Do Son on SecurityOnline[.]info notes that there are no confirmed active public exploits at the time of publication, although the Tor whitelist issue potentially exposed a large portion of the network by enabling reachable mainnet nodes to whitelist all incoming Tor connections.

CVE-2025-62861 concerns a mempool handling bug triggered during chain reorgs in version 3 (TRUC) transaction rules. When a node drops blocks during a reorg, it re-adds transactions to the mempool with bypass_limits set to true, and a mis-gating of the sibling-eviction branch allowed TRUC enforcement to run while transactions were re-added. This could cause a parent transaction to be evicted while its children remain in the mempool, breaking block template creation until the mining node is restarted.

CVE-2025-62860 covers the -whitelist option, where inbound Tor peers could inherit the local IP, effectively bypassing privacy mitigations and DoS controls for trusted peers. CVE-2025-62859 involves witness malleation in compact blocks; affected nodes could clear their download state before checking for malleation, allowing a bad peer to stall block delivery via repeated GETDATA timeouts. The report notes that three high-bandwidth peers or a -blocksonly node could sustain the stall.