Bitcoin Core discloses three flaws, one high severity

Bitcoin Core has published details of three security vulnerabilities, one rated high severity and two medium, two weeks after a pre-announcement. All three are fixed in 29.2 and later 29.x releases, and in 30.0 and every later version, Antoine Poinsot wrote on the Bitcoin development mailing list.

CVE-2025-62861 is a mempool inconsistency in how the software handles chain reorganizations. It can be exploited to stop a miner from obtaining valid block templates.

CVE-2025-62860 is an incorrect application of whitelist privileges to inbound Tor connections. It can be used to knock a node offline or to make it leak internal state.

CVE-2025-62859 is a misplaced check for witness malleation. A malicious peer can use it to stall block processing.

The disclosure does not say which of the three carries the high rating.