Bitcoin Core has disclosed three security vulnerabilities in the software that runs most of the Bitcoin network, including one high-severity bug that could have disrupted mining, all of which have since been fixed.

The flaws, detailed in a batch of security advisories published by the project, span denial-of-service and privacy issues rather than anything that would have let an attacker steal coins or forge bitcoin. Developers reported no evidence that the flaws were exploited in the wild.

Bitcoin Core, the open-source reference implementation run largely by volunteer developers, operates the majority of nodes on the network—the independent computers that verify every transaction and block for themselves—so flaws in the software touch a wide swath of Bitcoin's validation infrastructure. The project classifies vulnerabilities into four tiers, running from "low" through "medium" and "high" to "critical." None of the three reached the "critical" tier, falling instead in the middle of the range. Bitcoin Core reserves that top level for bugs that threaten coin theft at the protocol level, unauthorized coin creation, or permanent network-wide chain splits.

Mempool corruption risk

The most serious issue, tracked as CVE-2025-62861, concerns block template creation, the process miners rely on to assemble new blocks. According to the advisory, a chain reorganization—a scenario in which the network replaces recently built blocks with a competing chain—could trigger an erroneous eviction of certain transactions. That would corrupt a node's mempool, its waiting room for unconfirmed transactions, leaving the affected node unable to build block templates until it was restarted.

For a miner, that means a halt to the very work that earns block rewards—the newly issued bitcoin and transaction fees paid with each block.

A second flaw, CVE-2025-62859, could let a peer stall a node's block processing by announcing a compact block with a manipulated witness, a form of transaction malleation. Compact blocks are a bandwidth-saving relay format in which nodes exchange short transaction identifiers instead of full block data.

The third flaw, CVE-2025-62860, was a privacy and security issue in which inbound connections over the Tor anonymity network were wrongly granted "whitelist" permissions, lifting various denial-of-service and privacy protections on affected nodes.

AI-era disclosure policy

The disclosures come amid a broader reckoning over how quickly Bitcoin's defenders can keep pace with a shifting threat landscape. Bitcoin Core recently rewrote its security policy to account for AI, adding a category for "easily discoverable" vulnerabilities that can be surfaced through a simple AI prompt. Bugs in that category are now patched and disclosed immediately rather than held under a long embargo.

That shift reflects mounting concern that large language models have lowered the bar for finding flaws, a worry underscored by the volunteer "Bitcoin Red Team," which has been racing to uncover AI-discoverable bugs across the ecosystem before attackers can exploit them. That hunt is still underway, making the intersection of AI-assisted bug discovery and immediate disclosure one to watch.

The fixes themselves shipped earlier, with the advisories following under Bitcoin Core's disclosure timeline—a sequencing that gives node operators a window to update before the technical details are public. Node operators are generally urged to run the latest software to stay protected, since older releases do not carry these fixes.