Bitcoin Core publicly disclosed three security vulnerabilities on November 10, 2023, all of which had been patched in versions released in October 2025. This disclosure followed a 13-month delay after the patches were implemented, a practice now under scrutiny due to advancements in artificial intelligence and the potential for easier rediscovery of old vulnerabilities.
The vulnerabilities, identified by CVE numbers CVE-2025-62860, CVE-2025-62861, and CVE-2025-62859, affected thousands of mainnet nodes, miner nodes, and the reconstruction process of compact blocks. While these flaws did not allow for coin theft or double-spending, they could disable nodes, prevent block production, and potentially compromise the privacy protection of Tor users.
Vulnerability Details and Impact
One vulnerability, CVE-2025-62860, allowed thousands of externally accessible mainnet nodes to treat all incoming Tor connections as trusted. This was reportedly due to a mismatch between default settings and deployment topology, where a whitelist intended for trusted local machines inadvertently trusted Tor connections. Another vulnerability, CVE-2025-62861, was rated high-risk and could prevent miner nodes from producing valid block templates until they were restarted. The third vulnerability, CVE-2025-62859, could cause malicious peer nodes to stall block processing for 10 minutes, with the potential for repeated exploitation.
The Disclosure Convention Under Scrutiny
Bitcoin Core’s convention for disclosing medium and high-risk vulnerabilities typically involves a delay after patching. However, the 13-month gap in this instance has prompted discussion about the adequacy of such timelines. Bitcoin Core updated its rules in October 2026 to synchronize patching and disclosure for certain types of vulnerabilities, particularly those that are easily rediscovered by AI.
Implementation Risks and Evolving Landscape
The disclosure highlights a broader trend where the true vulnerability of systems like Bitcoin may lie not in their core consensus rules, but in the implementation and deployment details of their node software. These types of flaws can be difficult to catch through traditional code audits or fuzz testing, appearing only in real-world installation methods.
Uncertainties and Future Considerations
Uncertainties remain regarding the exact number of nodes still running affected versions of Bitcoin Core (versions 28.x, 29.0, and 29.1), which impacts the real-world exposure of CVE-2025-62861. It is also unclear whether vendors packaging Bitcoin Core with Tor have updated their default configurations or which specific vendors were initially notified about CVE-2025-62860.
The practice of delaying vulnerability disclosures is facing increasing pressure. The ease with which AI can rediscover old vulnerabilities is prompting open-source projects to reconsider their disclosure policies to better align with current security challenges.
Why This Matters
The materials describe a narrow update: Bitcoin Core publicly disclosed three security vulnerabilities on November 10th, 2023, which had been patched in versions released in October 2025. The exact number of nodes still running affected versions of Bitcoin Core (28.x, 29.0, 29.1) which determines the real-world exposure of CVE-2025-62861.
Broader Context
Source materials place the factual news in this context: Bitcoin Core disclosed three security vulnerabilities on November 10, 2023, all of which were patched in October 2025, but details were withheld for 13 months.
