---
title: Bitcoin Core discloses three fixed bugs: a reorg mempool bug that halted block templates, Tor peers wrongly whitelisted, and a block-processing stall | ctxsec
url: https://ctxsec.com/items/bitcoin-core-discloses-cve-2025-62859-62860-62861-fixed-in-30-0-29-2
description: "After the last vulnerable 29.x line reached end of life, Bitcoin Core published three advisories. CVE-2025-62861 (high) let TRUC 'sibling eviction' fire while transactions were re-added during a reorg, leaving an inconsistent mempool that could halt block-template creation (affects 28.0 to 28.2 and 29.0 to 29.1; fixed in 30.0). CVE-2025-62860 (medium) whitelisted inbound Tor peers when the Tor daemon's address fell in a -whitelist range, which Bitcoin Core says left thousands of reachable nodes whitelisting all Tor inbound connections. CVE-2025-62859 (medium) let a malicious peer stall block processing through witness malleation in compact blocks."
status: "official (Bitcoin Core security disclosures, Nov 10, 2026); all fixed in 2025 releases"
published: 2026-11-11
---

> After the last vulnerable 29.x line reached end of life, Bitcoin Core published three advisories. CVE-2025-62861 (high) let TRUC 'sibling eviction' fire while transactions were re-added during a reorg, leaving an inconsistent mempool that could halt block-template creation (affects 28.0 to 28.2 and 29.0 to 29.1; fixed in 30.0). CVE-2025-62860 (medium) whitelisted inbound Tor peers when the Tor daemon's address fell in a -whitelist range, which Bitcoin Core says left thousands of reachable nodes whitelisting all Tor inbound connections. CVE-2025-62859 (medium) let a malicious peer stall block processing through witness malleation in compact blocks.

[← Cybersecurity News](/news) · [markdown](/items/bitcoin-core-discloses-cve-2025-62859-62860-62861-fixed-in-30-0-29-2.md)

official (Bitcoin Core security disclosures, Nov 10, 2026); all fixed in 2025 releases

2026-11-11 11:37 AM ET

### Bitcoin Core discloses three fixed bugs: a reorg mempool bug that halted block templates, Tor peers wrongly whitelisted, and a block-processing stall

- **Fixed in:** 30.0 for all three; 29.2 for CVE-2025-62859 and CVE-2025-62860; 28.3 for CVE-2025-62860.
- **Check:** nodes and miners still on 28.x or 29.0/29.1, and bundled node distributions that set `-whitelist` to the local Tor daemon's range.
- The advisories describe responsible disclosure and fixes released in October 2025; they do not report exploitation.

Sources: [Bitcoin Core: CVE-2025-62861, block template creation halted by TRUC sibling eviction during reorg](https://bitcoincore.org/en/2026/11/10/disclose-cve-2025-62861/) · [Bitcoin Core: CVE-2025-62860, inbound Tor connections wrongly receive -whitelist permissions](https://bitcoincore.org/en/2026/11/10/disclose-cve-2025-62860/) · [Bitcoin Core: CVE-2025-62859, block processing stall via witness malleation](https://bitcoincore.org/en/2026/11/10/disclose-cve-2025-62859/)