Bitcoin Core says a high-severity flaw can stop a node from building block templates after a chain reorganization, and that the fix shipped in October 2025.
Bitcoin Core has disclosed a high-severity flaw that can stop a node from building block templates after a chain reorganization. The project says the fix shipped in October 2025, and that it published the details on November 10, 2026.
The bug is in how the software restores transactions after a reorg. Bitcoin Core says CVE-2025-62861 affects versions 28.0 through 28.2 and 29.0 through 29.1. During a reorganization, transactions from disconnected blocks are put back into the mempool with a setting that is supposed to skip topology limits. The project says a sibling-eviction check for version 3 transactions still ran, and could remove a restored transaction while leaving later transactions that spent it. Bitcoin Core says a node that hits the bug cannot produce blocks until it is restarted.
The fix is already in released versions. Bitcoin Core says version 30.0, released on October 10, 2025, includes the fix, as do version 29.2 on October 14 and version 28.3 on October 17. It credits Niklas Goegge with finding the flaw. It says the last vulnerable 29.x release went end of life on October 27, 2026, before the public disclosure.
Two medium flaws were disclosed the same day. Bitcoin Core rates CVE-2025-62861 as medium. It says a peer can stall block processing by announcing a compact block with a malleated witness, and that the stall can be repeated if the peer is one of the node's three high-bandwidth peers or if the node is running in blocks-only mode. Versions before 29.2 and 30.0 are affected. It credits Eugene Siegel. A second medium flaw, CVE-2025-62861, gave inbound Tor connections whitelist permissions when a node had set the non-default whitelist option to an address range that matched its Tor daemon. Bitcoin Core says nodes that did not set that option were never affected, and that vendor bundles left thousands of reachable nodes whitelisting incoming Tor connections. That fix is in 28.3, 29.2, and 30.0.
Tap a lens to see what this story means for you.
Liked this? The Brief brings you the whole day in tech, verified, every morning.
Two minutes, free forever. What's in The Brief →
See what’s happening right now
The Feed runs all day — short, verified briefs the moment they break.
Open the FeedFollow @thecircuitry_
Every story we publish, as it happens. No noise between.
Reader-supported
The Circuitry is a passion project I've always wanted to build, and I love the work behind it.
Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.
Any contribution is appreciated. If not, no pressure. Thanks for reading.
Google says home keys in Wallet work with compatible Aliro locks in the Google Home app. Tap to unlock needs Android 9 or later. Wear OS watches are not supported at launch.
Google says the Gemini Decisions API is available in Google AI Studio, priced at $0.10 per million input tokens, with no charge for output tokens.
Amazon says AWS Emulator is available for download, that autonomous agents wrote every line, and that the team has not reviewed the code.
Google says the Gemini app is rolling out on Apple CarPlay starting today, for all Gemini users on iOS in every language Gemini Live already supports.
Databricks says the new always-on Genie is coming soon to preview and beta programs, while the current Genie and Genie Ontology are already generally available.
