--- title: "Bitcoin Core Discloses High-Severity TRUC Bug Halting Block Creation During Reorgs" description: "A flaw in version 3 transaction sibling eviction could halt block template generation during reorganizations, fixed across versions 28.3, 29.2, and 30.0." url: https://basisdesk.news/news/bitcoin-core-cve-2025-62861-truc-mempool-bug published: 2026-11-10T20:16:25.266Z modified: 2026-11-10T20:16:25.266Z section: Security & Hacks author: Basis Desk Newsroom (AI-generated, source-verified) sentiment: neutral tickers: [BTC] tags: [Bitcoin Core, TRUC, BIP 431, Mining, Mempool, Vulnerability] license: Quote with attribution to Basis Desk (basisdesk.news). Not financial advice. --- # Bitcoin Core Discloses High-Severity TRUC Bug Halting Block Creation During Reorgs A flaw in version 3 transaction sibling eviction could halt block template generation during reorganizations, fixed across versions 28.3, 29.2, and 30.0. ## At a glance - **What happened:** Bitcoin Core disclosed a high-severity bug, CVE-2025-62861, that broke block template generation during chain reorganizations. - **Why it matters:** The bug could freeze block creation on mining nodes until restarted due to corrupted mempool states under TRUC sibling eviction logic. - **Who is affected:** Bitcoin miners and node operators who ran unpatched Bitcoin Core versions 28.0-28.2 and 29.0-29.1. - **What's next:** No next step announced, as the vulnerability was patched in late 2025 and the affected versions have reached end of life. - **Primary source:** [CVE-2025-62861 - Block template creation halted by TRUC sibling eviction during reorg](https://bitcoincore.org/en/2026/11/10/disclose-cve-2025-62861/) — Bitcoin Core ## Key points - CVE-2025-62861 triggered mempool inconsistencies during chain reorganizations due to unguarded TRUC sibling eviction logic. - Affected mining nodes could not construct valid block templates following a reorganization until restarted. - Bitcoin Core patched the flaw in October 2025 across v30.0, v29.2, and v28.3, delaying full disclosure until after branch deprecation. ## Editorial remark - **Context:** Bitcoin Core introduced sibling eviction for v3 TRUC transactions in version 28.0 to improve mempool fee replacement rules under BIP 431. - **Impact:** Miners running vulnerable versions faced halted block production following chain reorgs until software restarts, though patched releases fully resolved the flaw. - **Watch:** Node operators running legacy installations should confirm they have upgraded beyond Bitcoin Core 29.1 to avoid the deprecated codebase. Bitcoin Core publicly disclosed a high-severity vulnerability tracked as CVE-2025-62861 on Nov. 10, 2026, detailing an issue that caused mempool inconsistencies and prevented mining nodes from generating valid block templates following a blockchain reorganization [1]. The flaw originated in the software's handling of Topologically Restricted Until Confirmation (TRUC) transactions and impacted Bitcoin Core versions 28.0 through 28.2 alongside versions 29.0 through 29.1 [1]. Under standard transaction relay policy defined in BIP 431, $BTC TRUC transactions limit unconfirmed topologies to one ancestor and one descendant [1]. When an incoming transaction attempts to attach a second child to a TRUC parent, Bitcoin Core utilizes "sibling eviction" to replace the existing child under replace-by-fee rules [1]. However, during a blockchain reorganization, disconnected transactions return to the mempool with typical limits bypassed to restore historical state [1]. Because the sibling eviction routine failed to check this bypass flag, TRUC validation executed during reorg re-additions [1]. This oversight allowed the mempool to evict restored transactions while preserving their dependent children, stranding transactions that spent non-existent outputs [1]. ## Impact on Mining Operations The resulting mempool corruption left affected nodes unable to generate valid block templates, failing internal validity checks until node operators restarted the daemon to reload clean mempool state [1]. Developer Niklas Goegge reported the vulnerability to the Bitcoin Core security mailing list on Sept. 26, 2025, after which developer Greg Sanders submitted PR #33504 to gate the eviction checks behind the reorg bypass flag [1]. The issue was resolved in the Bitcoin Core v30.0 release on Oct. 10, 2025, followed by backported updates in v29.2 on Oct. 14, 2025, and v28.3 on Oct. 17, 2025 [1]. The project delayed public disclosure until Nov. 10, 2026, following the end-of-life status of the remaining affected release line on Oct. 27, 2026 [1]. At the time of writing, $BTC traded at $73,424. ## FAQ **Which Bitcoin Core versions were vulnerable to CVE-2025-62861?** Bitcoin Core versions 28.0 through 28.2 and 29.0 through 29.1 contained the vulnerability. **How did the bug impact Bitcoin miners?** Following a chain reorganization, inconsistent mempool states prevented nodes from building valid block templates until restarted. ## Sources 1. [CVE-2025-62861 - Block template creation halted by TRUC sibling eviction during reorg](https://bitcoincore.org/en/2026/11/10/disclose-cve-2025-62861/) — Bitcoin Core, 2026-11-10 --- Basis Desk Newsroom · AI-generated, source-verified · https://basisdesk.news/about/how-we-use-ai