Bitcoin client vulnerabilities put thousands of network nodes at risk

Traders Union
All News
Crypto
Vulnerabilities in Bitcoin client

A bug could have prevented the creation of new blocks

The second vulnerability was classified as high severity because it affected mining nodes.

The bug occurred during blockchain reorganizations, when the network abandons one version of the chain in favor of another. In such cases, transactions from discarded blocks may return to the mempool, a queue of transactions awaiting confirmation.

However, a rule introduced in Bitcoin Core 28.0 could, under certain circumstances, remove one of these restored transactions while leaving related transactions behind. As a result, a mining node could attempt to construct a block containing transactions with missing inputs.

The validation system would reject such blocks as invalid. An affected node would lose the ability to generate valid block templates until the software was restarted.

Developer Niklas Goegge reported the issue on September 26, 2025. The official advisory, however, does not mention any known cases of attackers exploiting the vulnerability.

The third bug, rated medium severity, allowed a malicious connection to delay the processing of new blocks for ten minutes. If an attacker controlled all three connections used for fast block relay, they could repeat the attack indefinitely.

Why developers waited a year to disclose the vulnerabilities

Bitcoin Core follows a delayed vulnerability disclosure policy. Details of medium- and high-severity issues are typically published two weeks after the last affected software release reaches the end of its support period.

This approach gives node operators additional time to install updates and reduces the risk of known vulnerabilities being exploited.

Support for the last vulnerable release series, Bitcoin Core 29.x, ended on October 27, 2026. This explains why detailed information about the issues was not published until November 10.

However, the code fixing the Tor vulnerability had been publicly available on GitHub since September 2025. Moreover, the title of the corresponding change explicitly stated that whitelist privileges should not apply to incoming Tor connections.

In October, Bitcoin Core developers also revised their disclosure rules for vulnerabilities that can be easily rediscovered, including with the help of artificial intelligence. In such cases, fixes and security advisories are now expected to be released as quickly as possible. The three vulnerabilities disclosed in November, however, followed the previous disclosure schedule.

Why Bitcoin Core is so important

Bitcoin Core is the primary software implementation supporting the Bitcoin network. It allows users to run full blockchain nodes, verify transactions, validate new blocks, and relay information to other network participants. The software is open source and maintained by an independent community of developers. Bitcoin also has alternative clients, such as Bitcoin Knots and btcd, which follow the same network rules.

Nevertheless, Bitcoin Core remains the dominant implementation. According to Coin Dance, it is used by approximately 90% of publicly reachable network nodes. This concentration makes the software's security critically important to the entire ecosystem. A serious Bitcoin Core bug could potentially affect thousands of nodes simultaneously, disrupt the propagation of transactions and blocks, and cause problems for miners. However, Bitcoin itself remains a decentralized network, meaning that a failure in one client does not necessarily bring the entire blockchain to a halt.

As a reminder, the Bitcoin Core team previously disclosed vulnerabilities identified with the help of AI.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.