Bitcoin Core discloses 3 vulnerabilities at once: Is your node version up to date?
The bottom line: According to three disclosures published on the Bitcoin Core website on November 10, these issues affect the node’s mempool, block propagation, and connection permissions. None involves private keys or forged transactions. The fixes were released back in October 2025; only now are the details being made public.
What each of the 3 vulnerabilities does:
1. CVE-2025-62861 (high severity): During a chain reorganization, the “sibling replacement” rule for TRUC (v3) transactions can be triggered incorrectly, leaving transactions in the mempool that spend outputs that no longer exist. As a result, the node cannot generate block templates until it is restarted. Affected versions: 28.0–28.2 and 29.0–29.1. This is most damaging for miners and mining pools.
2. CVE-2025-62860 (medium severity): Nodes configured with -whitelist to allow IP ranges can also treat incoming Tor connections as whitelisted, disabling some DoS protections and privacy safeguards. The official disclosure says that because some bundled packages use this configuration by default, thousands of reachable nodes on the mainnet are affected. Nodes without -whitelist configured were never affected.
3. CVE-2025-62859 (medium severity): A malicious node can use compact blocks with tampered witness data to make a victim node get stuck waiting for the 10-minute timeout. This can be repeated indefinitely if the attacker controls all 3 of your high-bandwidth nodes, or if you have -blocksonly enabled.
The timeline is also worth noting: The earliest issue (62859) was reported on April 28, 2025, about 18 months before it was publicly disclosed. The reason is that the developers waited until the last affected release branch, 29.x, reached end of support on October 27, 2026, before publishing the details.
How to check, in two steps:
1. Run bitcoin-cli getnetworkinfo and check the subversion field. Version 30.0 and later fix all three; 29.2 fixes all three; 28.3 fixes the first two (the original disclosure for 62859 lists only 29.2 and 30.0). Version 29.x reached end of support on October 27, so the safest option is to upgrade to a release branch that is still supported.
2. If you use a bundled node package with a graphical interface, check its settings to see whether an IP range is configured under -whitelist, and confirm that the Core version included in the package is later than the versions listed above.
According to the disclosures, people who only hold coins on exchanges or in mobile wallets and do not run their own nodes do not need to take any action in response to this issue.
This article does not constitute investment advice.
#比特币 #安全 #BitcoinCore #节点 $BTC
The bottom line: According to three disclosures published on the Bitcoin Core website on November 10, these issues affect the node’s mempool, block propagation, and connection permissions. None involves private keys or forged transactions. The fixes were released back in October 2025; only now are the details being made public.
What each of the 3 vulnerabilities does:
1. CVE-2025-62861 (high severity): During a chain reorganization, the “sibling replacement” rule for TRUC (v3) transactions can be triggered incorrectly, leaving transactions in the mempool that spend outputs that no longer exist. As a result, the node cannot generate block templates until it is restarted. Affected versions: 28.0–28.2 and 29.0–29.1. This is most damaging for miners and mining pools.
2. CVE-2025-62860 (medium severity): Nodes configured with -whitelist to allow IP ranges can also treat incoming Tor connections as whitelisted, disabling some DoS protections and privacy safeguards. The official disclosure says that because some bundled packages use this configuration by default, thousands of reachable nodes on the mainnet are affected. Nodes without -whitelist configured were never affected.
3. CVE-2025-62859 (medium severity): A malicious node can use compact blocks with tampered witness data to make a victim node get stuck waiting for the 10-minute timeout. This can be repeated indefinitely if the attacker controls all 3 of your high-bandwidth nodes, or if you have -blocksonly enabled.
The timeline is also worth noting: The earliest issue (62859) was reported on April 28, 2025, about 18 months before it was publicly disclosed. The reason is that the developers waited until the last affected release branch, 29.x, reached end of support on October 27, 2026, before publishing the details.
How to check, in two steps:
1. Run bitcoin-cli getnetworkinfo and check the subversion field. Version 30.0 and later fix all three; 29.2 fixes all three; 28.3 fixes the first two (the original disclosure for 62859 lists only 29.2 and 30.0). Version 29.x reached end of support on October 27, so the safest option is to upgrade to a release branch that is still supported.
2. If you use a bundled node package with a graphical interface, check its settings to see whether an IP range is configured under -whitelist, and confirm that the Core version included in the package is later than the versions listed above.
According to the disclosures, people who only hold coins on exchanges or in mobile wallets and do not run their own nodes do not need to take any action in response to this issue.
This article does not constitute investment advice.
#比特币 #安全 #BitcoinCore #节点 $BTC
