From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Tue, 10 Nov 2026 13:31:04 -0800 Received: from mail-oa1-f61.google.com ([209.85.160.61]) by mail.fairlystable.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.94.2) (envelope-from ) id 1xQtQm-000LIU-3P for bitcoindev@gnusha.org; Tue, 10 Nov 2026 13:31:04 -0800 Received: by mail-oa1-f61.google.com with SMTP id 586e51a60fabf-46f178d813bsf2407838fac.3 for ; Tue, 10 Nov 2026 13:31:03 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1794346258; cv=pass; d=google.com; s=arc-20260327; b=AZP1AoYSb82GDIhp78Xl4Uow5JrS6ifZR6saqyf8mtZz028QsUfpASWxjqWYPR+34/ 56F2GbGUDwgA2+0YmyXB4vmxPWyw7lSSFcpa+bAs7ie2PfBwVqMelhc5h4C4OsDIVUM0 4I5T40FifgLQeWlTQn314XZ2zIHauqIcc+FXvzofVNrEPeS3700dAXAQ/eIK4fH44Kol KRxawMUs7uDSMUf9EpJ//joQm5WvDMLxbP2F2g/OcPrsUaBCHUBWRWHh97vRJp4Xx9YL cZvs6xW5SPKt3MtxYXvgqUHn6ucSPeQZEvpDBSem3b7jjCyEtyY2jChnG0s8ydy4n/Qy RfOQ== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to:mime-version:feedback-id :message-id:subject:from:to:date:dkim-signature; bh=7GG5tC7XQZaRm/ylgFfMru0rYRbWVuAFGAgtD21dELk=; fh=xee/t+XOKwcBRTFeU7Q7PLNNAeul9NS9rysdZK9YnNU=; b=nSu6DYDJ5vXAcE4itp4X8DCUmPc0LQGF8pwalN+U0Ab7bOMR41Qk9fXAzEBavMORB5 01/VmgCkm2RHG2P2y8cFX5JALPMSFzrv3EgWMX5hSjvtGudNbzCPIFAR/eNOWCrjaEqM U7c/g5Z/BPJIBG/n0O1TGudUyG2Eo4MHCNzvO/WFCvL3aTb8zPDwm5H2lgkfMDlgv3Kv x4Q5DbhjHPHcFoBrmju11o1skxLue7SVBE9nptq23cCqAVlVls+/v1DXLqmild7LefKJ ZHWj71btHdsDB9cSiWThnK+NemQR0s766FM72T1H1LVWf7K8sD/0jBfFIF5lxIijclLz QRQg==; darn=gnusha.org ARC-Authentication-Results: i=2; gmr-mx.google.com; dkim=pass header.i=@protonmail.com header.s=protonmail3 header.b=P3V1RPUF; spf=pass (google.com: domain of darosior@protonmail.com designates 79.135.106.119 as permitted sender) smtp.mailfrom=darosior@protonmail.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=protonmail.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20260707; t=1794346257; x=1794951057; darn=gnusha.org; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:content-type :mime-version:feedback-id:message-id:subject:from:to:date:from:to:cc :subject:date:message-id:reply-to:content-type; bh=7GG5tC7XQZaRm/ylgFfMru0rYRbWVuAFGAgtD21dELk=; b=UI+VpCmuxm5xa9tQw2xWaicjr44W5u9AoecgWcn5Op4fJVaxgLJJawf5dof2abiTo9 3xlCfoDxtX1IB5FPz0MMrLwHLuKELFjOyA+QbJCcRHOxUx9QZCx4f3GU6+sAxf+/4nnS Z9V0HY+JtharNaWAq0OaY8sxyD3JyqH53FlQyBBJJAxbEekGhMMXufrvgEcSp1LzaGp1 A8OtxS7FXoZ6WhvvUzw8V41NROXY8+8SCSfXrn73+W3SK2Jkm4el2EdNZtbXHPE0ZHqE toYGJd31uP99VCJn/badyj1vqaPm1jKYz0yE8kafsaWqRleSEHNRJOrZw5w9sZVIp3HE OWbw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794346258; x=1794951058; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:content-type :mime-version:feedback-id:message-id:subject:from:to:date :x-beenthere:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to:content-type; bh=7GG5tC7XQZaRm/ylgFfMru0rYRbWVuAFGAgtD21dELk=; b=2xx95UwtoMMIdfiRCx/9hfetsqFJWEbJn9M4BKAeY947mNWDG0ie8mWveBV91jc3D0 Qe51qTECE9GF7sHBzTUkBcOzKbMhJ7EfXc/Hkz8OQGaKQPQu1WD8TyefuFjkZp0P1qKI f+j7OkLmF/CgOh6xcX902DcvCQ3fj+tPlXwIxpfg0eY6lvIWo5alQLxIPIUxoYlBJPBj dgLy4peYN6yXnmMKUhyIYwL1apanlgY5aYzqiZ/cSEsTgLOrK3x9/ejqM37xtFTdWVGF BbpCLNgql+S5ZiW60zgpZK69qRVDwXPblQbZAED9e23Izu/ty0/QE3jqjGSolMlFk4dx 6pLA== X-Forwarded-Encrypted: i=2; AL+hErEMSiPTmEMadpiAOIrFX8q9+SAqcJl+KBw+o5iUmRvywBECQoDGlgtzCfPzr+gK8rPdTnsilESOo6Lq@gnusha.org X-Gm-Message-State: APuU4Z+l0/uQ+tjo1HnrY4fIl8CjgvjcUzKn8fFl+ezl413N7BNm4Z+d fq3nNkrSq7LusKXUbnYVDcPMGVfa5jlNdyU2yShlUVwrzf68AknTC0vK X-Received: by 2002:a05:6870:3355:b0:44c:5514:4e7b with SMTP id 586e51a60fabf-4ae4682ae36mr516415fac.2.1794346257712; Tue, 10 Nov 2026 13:30:57 -0800 (PST) X-BeenThere: bitcoindev@googlegroups.com; h="ATskLdf5uE23AwnAX84yVPm1QDotOh1H6Mq/mcWqqHeu6I7K0A==" Received: by 2002:a05:6871:cc0b:10b0:4a7:574:b089 with SMTP id 586e51a60fabf-4ae4554c07cls204411fac.2.-pod-prod-07-us; Tue, 10 Nov 2026 13:30:51 -0800 (PST) X-Received: by 2002:a05:6808:6b47:b0:55c:888:8c38 with SMTP id 5614622812f47-56b934497ffmr272586b6e.2.1794346251146; Tue, 10 Nov 2026 13:30:51 -0800 (PST) Received: by 2002:a05:6402:1c06:b0:6b4:8921:78e7 with SMTP id 4fb4d7f45d1cf-6b6fa1dbdefmsa12; Tue, 10 Nov 2026 12:39:08 -0800 (PST) X-Received: by 2002:a05:6402:428e:b0:6b7:221c:beb with SMTP id 4fb4d7f45d1cf-6b777083008mr429630a12.0.1794343146256; Tue, 10 Nov 2026 12:39:06 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1794343146; cv=none; d=google.com; s=arc-20260327; b=o6gOaw9+ZeMCk+Rb00NTtaqOSJxy7azxLJSNtMVWjISch748JYBjXms1lO3coJMLJb Uj8Wzq2GW9CQirghrmVDAWfOnNuqa91VbUC7p0jwTnCdqEhws82AG2BGQOj5aYCoe4bN R8QyieMk1Bde/JjyZc98r5eTkLWzLURAoFNqdKoxbnGJBN99Oo+/BnrkWnyJwH83y7tR sg5nVXxlQuNsPRaYIK9RWnUwNynLcPl2yJArqmNH3Beum/qH+0g2A1im6tYEYMbXLxWl 9L4nNwpEscdeQn6py88PGu+OIeo4OKjEO/lJWlU83DEnTr1sX44E+AiiI/hxrjn+uHfI 90sA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:mime-version:feedback-id:message-id :subject:from:to:date:dkim-signature; bh=yAbnQPp3e0bp8E9ULYjJVw/rAOjjlPShKThrorABiQ0=; fh=DMP0F9ULS1guKiqimntQRCN8ZraraesEgQuVcn7F0Z0=; b=XmNDECH0XJA76OahN4MDW1SbedJDp35O7nOsHRB5L4wdUedAfQzh7iSptKcaAQl988 WCU+zI71mHBtJJW1T17War/q1G34II1tp+MYDO2qcLHYAd+ty8djkbuGHXUFNabdmXrq uzq3E8u6+0HIK2pQyDLcYwFjPYANf+EZxcmuESrF7rayzEM4FeMKyn2YIlGUtYqC1EMt T+ARQuqOIBFaYjbuQfMnvtMQkXcp4HW/pyLw0qf198mjYEbQPXvSEbqOqdlTZ2NouMm4 esS/mkQ/5yb3gZOG2eN2nLFcoPQWJn2rbzXzDz2M3/dvTy28zfec309aYgMpVQ1Gy0SZ BHNQ==; dara=google.com ARC-Authentication-Results: i=1; gmr-mx.google.com; dkim=pass header.i=@protonmail.com header.s=protonmail3 header.b=P3V1RPUF; spf=pass (google.com: domain of darosior@protonmail.com designates 79.135.106.119 as permitted sender) smtp.mailfrom=darosior@protonmail.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=protonmail.com Received: from mail-106119.protonmail.ch (mail-106119.protonmail.ch. [79.135.106.119]) by gmr-mx.google.com with ESMTPS id 4fb4d7f45d1cf-6b7578f62easi52814a12.11.2026.11.10.12.39.06 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 10 Nov 2026 12:39:06 -0800 (PST) Received-SPF: pass (google.com: domain of darosior@protonmail.com designates 79.135.106.119 as permitted sender) client-ip=79.135.106.119; Date: Tue, 10 Nov 2026 20:39:01 +0000 To: Bitcoin Development Mailing List From: "'Antoine Poinsot' via Bitcoin Development Mailing List" Subject: [bitcoindev] Three Bitcoin Core security advisories Message-ID: Feedback-ID: 7060259:user:proton X-Pm-Message-ID: 51c6c3044522729fb0a8f6c7869cf3baa1fd400f MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" X-Original-Sender: darosior@protonmail.com X-Original-Authentication-Results: gmr-mx.google.com; dkim=pass header.i=@protonmail.com header.s=protonmail3 header.b=P3V1RPUF; spf=pass (google.com: domain of darosior@protonmail.com designates 79.135.106.119 as permitted sender) smtp.mailfrom=darosior@protonmail.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=protonmail.com X-Original-From: Antoine Poinsot Reply-To: Antoine Poinsot Precedence: list Mailing-list: list bitcoindev@googlegroups.com; contact bitcoindev+owners@googlegroups.com List-ID: X-Google-Group-Id: 786775582512 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-Spam-Score: -1.0 (-) Hi, Following the pre-announcement from two weeks ago, we are publishing today the details of three security vulnerabilities affecting Bitcoin Core. Two of those are medium severity. One is high severity. All of them are fixed in Bitcoin Core 29.2 and later 29.x releases, and in 30.0 and all later versions. - CVE-2025-62861 is a mempool inconsistency bug in reorg handling, which can be exploited to prevent a miner from obtaining valid block templates. https://bitcoincore.org/en/2026/11/10/disclose-cve-2025-62861/ - CVE-2025-62860 is an incorrect application of whitelist privileges on inbound Tor connections which can be exploited to DoS a node, or make it leak internal state. https://bitcoincore.org/en/2026/11/10/disclose-cve-2025-62860/ - CVE-2025-62859 is a misplaced witness malleation check, which lets a malicious peer stall block processing. https://bitcoincore.org/en/2026/11/10/disclose-cve-2025-62859/ For more information about Bitcoin Core's security disclosure policy, or to consult past security advisories, see https://bitcoincore.org/en/security-advisories/ Antoine Poinsot -- You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group. To unsubscribe from this group and stop receiving emails from it, send an email to bitcoindev+unsubscribe@googlegroups.com. To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/x8_ouI-b5d4xOuHCR353f-mt-bnpMdMK9joxUdYcVQdeiloXqBk2nZl1HNeyFPb-0a5Ef4z-v3EpT4NjjU85f6x5Cb2h-ZoVo7YrGcvEQ9E%3D%40protonmail.com.