Bitcoin Core developers have disclosed a high-severity vulnerability, identified as CVE-2025-62861, which impacted the ability of mining nodes to generate new blocks. The flaw originated from the sibling eviction rule introduced in version 28.0, causing mempool corruption during chain reorganizations. When the logic failed, nodes retained descendant transactions while dropping the parent, leading to invalid block templates.
The issue specifically affected Bitcoin Core versions 28.0 through 28.2 and 29.0 through 29.1. Researchers discovered that the inconsistency prevented nodes from passing validity checks, effectively halting block production. The only immediate workaround for operators of vulnerable nodes was a full restart, which forced the system to rebuild the mempool from scratch.
Security researcher Niklas Goegge reported the vulnerability on September 26, 2025, with developer Greg Sanders providing the subsequent fix. Patched versions 30.0, 29.2, and 28.3 were released in October 2025. The project team delayed the public disclosure of these details until the vulnerable 29.x software reached its end-of-life status to ensure network security.
The recent disclosure also included two additional bugs addressed in version 30.0, one of which could stall block processing, while another concerned incorrect permissions for inbound Tor connections. These findings follow a separate October batch of three vulnerabilities identified by the AI-powered scanner Project Loupe. Operators are advised to upgrade to the latest versions immediately.
