Bitcoin Core discloses three security flaws that were fixed a year ago, one of them rated high severity

The developers of Bitcoin Core, software used to run Bitcoin nodes, disclosed three security vulnerabilities on November 10, one of which they rate as high severity. All three were fixed in versions released in October 2025, and the details were published only after the last affected version line reached the end of its support, according to the project's advisories.

What the Bitcoin Core vulnerability disclosures say

The mining bug (high severity). Bitcoin Core applies extra rules to a type of transaction known as version 3, or TRUC, while transactions wait in a node's queue of unconfirmed transactions, the mempool. When the blockchain reorganizes, replacing recent blocks with a competing set, the node puts transactions from the discarded blocks back into its mempool. In versions 28.0 to 28.2 and 29.0 to 29.1, one of those rules was wrongly applied during that step, which could leave the mempool in an inconsistent state, the advisory says. A miner's node in that state could not assemble a valid block template, so it could not produce blocks until it was restarted. The fix was released in version 30.0 on October 10, 2025, and in versions 29.2 and 28.3 later that month, according to the advisory's timeline.

The block-processing stall (medium). In versions before 29.2 and 30.0, a malicious peer could delay a node's processing of a new block by sending a tampered compact block, according to the advisory. An attacker who controlled a node's three high-bandwidth peers, or who targeted a node running in blocks-only mode, could repeat this indefinitely. Eugene Siegel discovered and reported it in April 2025, the advisory says.

The Tor permissions issue (medium). Nodes can be configured to give trusted peers a "whitelist" status that lifts some protections. In versions before 28.3, 29.2 and 30.0, incoming connections over the Tor network could wrongly receive that status when the whitelist covered the address of the local Tor service, the advisory says. Because popular node packages shipped with such a configuration, thousands of reachable nodes were whitelisting all incoming Tor connections, according to the project. Nodes that never set the option were not affected.

Why the details are public only now

Under Bitcoin Core's disclosure policy, the details of medium- and high-severity vulnerabilities are published two weeks after the last affected release reaches the end of its life. The three advisories give October 27, 2026, as the date the last vulnerable version line, 29.x, reached end of life, and November 10 as the date of public disclosure.

Why it matters

The disclosures show that a high-severity bug reached released versions of Bitcoin Core, and that all three flaws were fixed about a year before the details were published. The project defines high severity as "bugs with a significant impact on affected nodes or the network"; its most serious class, critical, covers bugs that allow coin theft, the creation of extra coins or a permanent network split, and none of the three is rated critical.

What it could mean for node operators and miners

Anyone still running a Bitcoin Core version from the affected lines is running software with publicly documented flaws. The advisories point to the fixed versions: 30.0 or later, or the patched 29.x and 28.x releases named in each advisory. The mining bug concerns nodes that build block templates, the job of miners such as MARA; the advisory describes a restart as the way out of the stuck state.

Two other security warnings came this week: LNbits told operators to upgrade after attacks on its Lightning wallet software, and Binance warned of an iOS flaw it says could expose wallet keys.