Bitcoin Core vulnerabilities disclosed on November 10, 2026, include a high-severity flaw that could stop an affected miner from creating block templates after a chain reorganization. The Bitcoin Core project says all three issues had already been fixed in earlier releases, and it published the details after older vulnerable versions reached end of life.
Why it matters
The flaws touched block template creation, block processing and permissions for some inbound Tor connections, but they did not affect every Bitcoin node. The disclosure matters because it clarifies risks in older software and gives node operators specific versions and configurations to check, rather than signaling a newly discovered network-wide outage.
What we know about Bitcoin Core vulnerabilities
Bitcoin Core published three advisories on November 10, describing one high-severity issue and two medium-severity issues. The Block reported that the most serious flaw affected block template creation. U.Today added that a chain reorganization could leave a miner’s mempool in an inconsistent state. The project’s own advisory gives the operational consequence: an affected node could be unable to create block templates until it was restarted.
Bitcoin Core vulnerabilities and the mining bug
The high-severity issue, CVE-2025-62861, affected Bitcoin Core versions 28.0-28.2 and 29.0-29.1, according to the official Bitcoin Core advisory. It was reported by security researcher Niklas Goegge on September 26, 2025. A reorganization, in which the network replaces previously accepted blocks with another chain, could trigger a problem involving TRUC transaction checks and sibling eviction. The result was a local block-template failure, not a claim that Bitcoin’s entire network stopped producing blocks.
The two medium-severity issues affected different parts of node operation. CVE-2025-62859 involved transaction witness data: a malicious peer could stall block processing for up to a 10-minute timeout. The advisory says the stall could be repeated indefinitely if an attacker controlled all three of a node’s high-bandwidth peers, or if the node used the -blocksonly setting.
CVE-2025-62860 concerned inbound Tor connections. Bitcoin Core said thousands of reachable mainnet nodes could be affected when a Tor proxy’s IP matched a configured -whitelist range, allowing incoming Tor peers to receive whitelist permissions. Nodes without that optional, non-default configuration were not affected. These vulnerabilities show why Bitcoin node security depends on both software versions and how individual operators configure their systems.
The fixes predated the public notices by more than a year. Bitcoin Core’s release information says version 29.2 included fixes for all three issues, while versions 30.0 and 29.2 were released in October 2025. The high-severity issue was also fixed in version 28.3. The project’s October 28, 2026, release notes said 29.x and older had reached end of life and previewed the disclosures. Bitcoin Core’s policy ordinarily delays medium- and high-severity disclosures until two weeks after the last affected release is no longer supported.
Bitcoin Core’s 29.2 release notes list fixes for compact-block witness checks, Tor inbound whitelist handling and TRUC checks during reorganizations. The mining issue was also fixed in version 28.3.
What is still unclear
The advisories identify affected versions and conditions, but the materials cited here do not quantify how many operators ran vulnerable software while the flaws were active or state whether any were exploited. The Tor advisory’s figure refers to thousands of reachable nodes with a particular configuration, not thousands of confirmed compromises.
The notices describe a potential failure mode on affected nodes. The materials cited here do not quantify how many miners experienced a block-template failure, report a confirmed interruption to Bitcoin’s consensus, or quantify operational losses.
That distinction matters when reading security headlines. A flaw can have serious consequences for a specific setup without meaning every node or miner was exposed. Bitcoin Core’s published version ranges and configuration notes are the clearest available guide to the scope.
How markets and analysts reacted
Bitcoin traded at $74,219 at 17:13 UTC on November 11, according to CoinGecko market data supplied for this report, up 1.78% over 24 hours. It was still down 7.51% over seven days and 10.19% over 30 days. The figures show a short-term rise amid a weaker monthly trend, but they don’t establish that the security disclosure caused either move.
The supplied coverage from The Block and U.Today focused on the technical implications and patch history, not a price forecast. The Crypto Fear & Greed Index stood at 29, classified as Fear, on November 11, according to Alternative.me. That reading is a broad sentiment measure, not evidence that traders were responding specifically to these advisories.
The supplied market data records Bitcoin’s price movements but does not attribute them to the security advisories. The available coverage focuses on the technical implications and patch history, not a market response.
What it means for investors
The notices concern vulnerabilities in Bitcoin Core software, which powers many nodes. Their effects depended on the software version and, for the Tor issue, a non-default configuration; the advisories do not describe a change to Bitcoin’s supply.
Node and mining software can affect the services that support a blockchain, and these advisories document risks tied to specific software versions and configurations. Bitcoin also remains exposed to market volatility: the supplied data showed its price down 10.19% over 30 days as of November 11. The advisories make no claim that future software will be free of defects.
The release history is the practical context: the fixes were available well before public disclosure, and the project waited until the vulnerable release series was out of support. Bitcoin Core listed October 27, 2026, as the end-of-life date for the last vulnerable 29.x release; it published the advisories on November 10, in line with its stated two-week disclosure policy.
Bottom line
Bitcoin Core disclosed three patched vulnerabilities, led by a reorganization-related flaw that could prevent block-template creation on affected versions until a restart. The advisories add detail about risks in older node software, but they do not report a current network-wide failure or establish a market impact.
Sources
- CVE-2025-62861 – Block template creation halted by TRUC sibling eviction during reorg (bitcoincore.org)
- Bitcoin Core Breaks Silence on Three Patched Security Vulnerabilities (U.Today)
- Bitcoin Core discloses three patched security flaws, including high-severity mining bug (The Block)
This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrencies are highly volatile; always do your own research before investing.
For advertising inquiries, please email . [email protected] or Telegram
