Bitcoin Core disclosed a medium-severity Tor flaw that gave inbound peers whitelist privileges on thousands of reachable mainnet nodes, granting connections permissions intended for trusted peers.
Bitcoin Core identifies inbound Tor connections by the Tor daemon’s address, which usually belongs to the same machine or local network. If an operator’s configured -whitelist IP range included that address, incoming Tor peers received whitelist permissions. Those permissions remove some denial-of-service limits and privacy-leak mitigations for trusted peers.
The issue required a nondefault configuration. The vulnerability affected only nodes configured with -whitelist. Some node packages bundled Bitcoin Core with Tor and configured a whitelist range covering the Tor daemon; some client software also required the setting. The affected peers could be unfamiliar connections arriving through Tor.
Martin Zumsande and Antoine Poinsot discovered the issue and reported it to the Bitcoin Core security team on Sept. 12, 2025. Fixes shipped in version 30.0 on Oct. 10, 2025; version 29.2 on Oct. 14; and version 28.3 on Oct. 20. The fix prevents inbound connections received through an onion address from receiving whitelist permissions.
Bitcoin Core disclosed the flaw, CVE-2025-62860, on Nov. 10, 2026. Its disclosure policy schedules public details of medium- and high-severity issues for two weeks after the last affected release series reaches end of life. The final vulnerable series, 29.x, reached end of life on Oct. 27, 2026.
The Nov. 10 disclosures also included a block-processing flaw and a mempool flaw that could prevent block-template creation after a chain reorganization.
Simon Yoon
Simon Yoon reports on blockchain technology for TokenPost. Send corrections or tips to [email protected].
