Bitcoin Core patched three flaws, one could halt mining templates

Bitcoin Core developers disclosed three security flaws in the reference software that runs most Bitcoin nodes, including a high-severity bug that could stop an affected node from building block templates until restarted. The flaws covered denial-of-service and privacy issues, not coin theft or forgery, and all have been fixed with no reported exploitation. For anyone holding bitcoin or running infrastructure around it, the episode is a reminder that node software needs regular updates.

Mempool corruption and stalled block templates

The most serious issue, tracked as CVE-2025-62861, concerns block template creation used by miners to assemble new blocks. According to the advisory, a chain reorganization could trigger an erroneous eviction of certain transactions and corrupt a node mempool, the waiting area for unconfirmed transactions. An affected node could then no longer build block templates until it was restarted, which for a miner means a halt to the work that earns block rewards. Bitcoin Core places vulnerabilities in four tiers from low to critical, and this flaw did not reach the critical tier.

A second flaw, CVE-2025-62859, could let a peer stall a node block processing by announcing a compact block with a manipulated witness, described as a form of transaction malleation. The third flaw, CVE-2025-62860, involved inbound connections over the Tor anonymity network being wrongly granted whitelist permissions. That error lifted various denial-of-service and privacy protections on affected nodes. None of the three reached the critical level that Bitcoin Core reserves for protocol-level coin theft, unauthorized coin creation or permanent network-wide chain splits.

What node operators and holders should do

For miners and node operators, the practical consequence is operational rather than financial loss of coins. A corrupted mempool or stalled block processing can interrupt block production and reduce availability until a restart and software update. Holders who do not run nodes face no direct action, but reliability of counterparties, exchanges and mining operations depends on those operators running current releases. The fixes shipped earlier, with advisories following under Bitcoin Core disclosure timeline, and operators are generally urged to run the latest software to stay protected.

These disclosures do not prove an attack occurred, and developers reported no evidence of exploitation. They also do not show a risk of forged bitcoin or stolen funds, which would fall under the critical category. What remains unknown from the advisories is how many nodes ran vulnerable versions at the time and whether any non-mining services experienced downtime. The flaws affect node operators, particularly miners and Tor users, rather than ordinary wallet users directly.