Some quick translation helps here. A block template is the draft block a miner assembles before trying to mine it. A chain reorganization happens when nodes drop a few recent blocks in favor of a competing chain.
Put those together and the bug could leave a node unable to produce a valid block template until it was restarted. Bitcoin Core describes it as something a reorg could trigger, not as a deliberate attack. It applied to Bitcoin Core versions 28.0 through 28.2 and 29.0 through 29.1. The flaw was reported on September 26, 2025.
The second issue, CVE-2025-62860, involves Tor connection whitelisting. Bitcoin Core said inbound Tor peers could wrongly inherit trusted permissions from the optional -whitelist setting. That lifted some denial-of-service limits and privacy protections. Bitcoin Core said “thousands” of reachable nodes were whitelisting all incoming Tor connections.
This one only bit operators who used the non-default -whitelist option with an IP range that covered their Tor proxy’s address. Some software bundles set it up that way. Default nodes were never affected.
The third flaw, CVE-2025-62859, concerned compact block processing. The bug let a malicious peer stall block processing for about 10 minutes at a time. It could repeat the stall indefinitely if it controlled all three of the victim’s high-bandwidth peers, or if the victim ran in -blocksonly mode. That issue was reported in April 2025.
Why the public is only hearing about this now
All three vulnerabilities were backported and fixed in Bitcoin Core releases from October 2025. Bitcoin Core 30.0 shipped on October 10, 2025, with the fixes already in place.
The timing follows the end of support for Bitcoin Core 29.x on October 27, 2026. That was the last version line still affected.
