Bitcoin Core Bug Disclosed 410 Days After Report Could Stall Miners

A Bitcoin Core bug that could prevent the node from constructing blocks has been hidden for 410 days. The vulnerability was reported in CVE-2025-62861 by Bitcoin Core on November 10, 2026, and has a severity of High. The end of life of the last release line with this vulnerability came two weeks before that.

The fix for the Bitcoin Core bug is old. Bitcoin Core released version 30.0 with the vulnerability fix on October 10, 2025, and versions 29.2 and 28.3 followed on October 14 and October 17. Nodes running those versions or newer are not vulnerable to this issue.

Which versions had the Bitcoin Core bug

The advisory lists 28.0 to 28.2 and 29.0 to 29.1 as affected. The start date of 28.0 is appropriate for the vulnerability because sibling eviction, which is the flaw here, was introduced in 28.0.

Sibling eviction is relevant for TRUC transactions, version 3. In accordance with BIP 431, a transaction with this property should have at most one unconfirmed ancestor and one unconfirmed descendant. If the second child appears with a sufficiently high fee, the first one can be replaced by the node.

These restrictions are part of relay policy and not consensus rules, so a legitimate block might have a TRUC parent with multiple children.

How a reorg tripped it

This is the problem that arises when the blockchain is being reorganized. Transactions coming from disconnected blocks get placed in the mempool with a bypass_limits flag which is supposed to skip the policy validation step. However, the sibling eviction does not respect this flag.

A restored transaction may get evicted but the descendant transactions will remain in the mempool. Thus, the mempool will end up having transactions which spend on non-existent outputs.

The advisory spells out the result: a miner's block template of a miner fails to pass validity check. Nodes undergoing this kind of reorganization will be unable to mine blocks until the node is restarted.

Timeline of the Bitcoin Core bug, from report to disclosure

The vulnerability was reported to the Bitcoin Core security mailing list by Niklas Goegge on September 26, 2025. Greg Sanders filed a fix patch PR 33504 three days after that. The patch was merged into the master branch on October 2.

The patches were backported to 29.x branch on October 3, 30.x branch on October 6, and 28.x branch on October 7. Bitcoin Core 30.0 version was released on October 10, which is 14 days from the report.

Then the clock slowed. The last branch that was affected by the vulnerability, 29.x, reached its end of life on October 27, 2026. The advisory was disclosed 14 days later.

The advisory text explaining why a node cannot build a block template after the reorg. Source: Bitcoin Core, CVE-2025-62861 disclosure.

What it means for miners

Whoever runs the mining software listed above requires one of the fixed releases. For all others, the page represents an historical document. It is an account of how the Bitcoin Core bug was discovered by the researcher and how the vulnerability was patched 14 days later in the latest release and 21 days in the two older releases.

A previous article on quantum landmines in Bitcoin discussed a completely different protocol vulnerability. This article summarizes a public security advisory and does not offer any investment advice.

Featured image: Bitcoin mining farm by Marko Ahtisaari, licensed CC BY 2.0, via Wikimedia Commons.