High-severity Bitcoin Core bug halts block creation on specific versions
Key Facts
Bitcoin Core published details on November 10, 2026, of a security vulnerability it rated high severity, saying its impact could prevent an affected node from creating blocks after a chain reorganization. The bug affects Bitcoin Core versions 28.0 to 28.2 and 29.0 to 29.1, according to the official disclosure. The impact concerns the node that experienced the reorganization, as validation of the block template it assembles fails. The project said the node cannot produce blocks until it is restarted, which reloads the memory pool in a consistent state. The disclosed impact is therefore confined to operation of the affected node, and the disclosure does not describe a broader disruption to the Bitcoin network.
The bug occurs when transactions from blocks that have been disconnected from the chain are reintroduced into the memory pool during a reorganization. The reintroduction path allows the usual policy limits to be bypassed, but the branch that evicts sibling transactions was not conditional on that bypass, according to Bitcoin Core's explanation. As a result, TRUC restrictions continued to be applied to transactions as they were reintroduced to the pool. This discrepancy can leave transactions that spend outputs that no longer exist in the new chain state. When the software tries to create a block template from the pool, template validity checks fail. Bitcoin Core says a restart resolves the state by reloading the pool consistently, allowing block creation to resume.
TRUC restrictions concern memory-pool policy and are not consensus rules that determine the validity of blocks across the network. The policy states that a TRUC transaction may have no more than one unconfirmed parent and one unconfirmed child in the pool. This means a transaction structure that may be accepted within a valid block cannot necessarily be formed in the memory pool under those restrictions. In the disclosed bug, application of this policy intersected with the reintroduction of transactions from disconnected blocks during a reorganization. According to the project, this interaction left transactions in the pool linked to nonexistent outputs. This explains how the affected node could be unable to assemble a valid template without the disclosure describing a flaw in the consensus rules themselves.
Bitcoin Core credited Niklas Gögge with discovering and responsibly reporting the vulnerability. He submitted it to the security mailing list on September 26, 2025. Three days later, Greg Sanders opened fix pull request number 33504 on September 29 of the same year. The fix was merged into the main branch on October 2, 2025, then backported to the 28.x branch through a separate pull request, number 33535, on October 7. The fix timeline shows that the project addressed the bug in the main branch and the relevant older release series. The details were publicly disclosed in November 2026, long after the patched versions had been released.
The fix was included in Bitcoin Core 30.0, released on October 10, 2025, then in version 29.2, released on October 14, and version 28.3, released on October 17. These versions were beyond the range of affected releases identified in the disclosure: 28.0 to 28.2 and 29.0 to 29.1. Under Bitcoin Core policy, medium- and high-severity vulnerabilities are disclosed two weeks after support ends for the last affected release. The policy says this period falls approximately one year after a major version containing the fix is released. Support for the 29.x series, the last series that included an affected version according to the disclosure, ended on October 27, 2026. The project published the vulnerability details on November 10, two weeks after that date.
The bug disclosure was part of a security batch Bitcoin Core published the same day, which also included CVE-2025-62859 and CVE-2025-62860, both rated medium severity. The project's policy defines high severity as bugs with a significant impact on affected nodes or the network, often remotely exploitable under default settings and potentially capable of causing widespread disruption. But the description of this vulnerability specifies an operational impact on the node that performed the reorganization and says a restart returns the pool to a consistent state. These details place the problem's scope in block creation on the affected node after a reorganization. Versions containing the fix had been released in October 2025, before the public disclosure in November 2026.