Bitcoin Core has disclosed three previously patched security vulnerabilities, including a high-severity bug that could stop affected mining nodes from producing valid block templates after a chain reorganization.

The project said the flaws affected Bitcoin Core versions 28.0 through 28.2 and 29.0 through 29.1. Fixes were first included in Bitcoin Core 30.0 in October 2025 and later in version 29.2, while the last vulnerable release remained in use until it went out of support in October 2026.

High-severity bug tied to chain reorganizations

The most serious issue involved a condition in which a transaction could be removed from a node’s mempool without its descendant transactions being removed as well. That left the mempool in an inconsistent state.

According to the disclosure, this could happen after a chain reorganization and would prevent affected mining nodes from generating valid block templates. In that state, miners would need to restart their nodes before they could resume creating valid templates.

Two medium-severity vulnerabilities also disclosed

Bitcoin Core also described a medium-severity flaw related to witness malleation in compact blocks. The issue could delay block processing, adding a second problem beyond the mining-related bug.

A separate medium-severity vulnerability involved whitelist permissions for incoming Tor peers. The disclosure said that issue could affect thousands of reachable mainnet nodes.

Fixes were released in 2025

All three vulnerabilities were addressed in Bitcoin Core 30.0, which shipped in October 2025. The project later released the same fixes in Bitcoin Core 29.2.

The public disclosure came after patched versions had already been distributed. That timeline meant users had access to fixes before the technical details were formally published.

Support timeline and what comes next

The last vulnerable version of Bitcoin Core remained supported until October 2026, when it reached end of support. With that milestone passed, the project has now detailed the flaws and the versions affected.

The confirmed next step is straightforward for operators still reviewing their setups: the patched releases are Bitcoin Core 30.0 and 29.2, while versions 28.0 to 28.2 and 29.0 to 29.1 were the affected builds named in the disclosure.

Source: www.theblock.co