Bitcoin Core Discloses Medium-Severity Vulnerability Allowing Inbound Tor Connections to Gain Whitelist Status

November 12: According to a Bitcoin Core security advisory, the medium-severity vulnerability CVE-2025-62860 was publicly disclosed on November 10, 2026. The flaw exists in versions prior to 28.3, 29.2 and 30.0. Because the IP addresses of inbound connections made externally via Tor are actually the addresses of the local Tor software, if such an address matches a trusted IP range configured through the -whitelist option, Bitcoin Core would incorrectly add these external Tor connections to the whitelist, thereby lifting the various anti-DoS restrictions and privacy-leak mitigation measures applied to trusted nodes.

The advisory noted that nodes that did not set the non-default -whitelist option were never affected. Many popular vendors bundle Bitcoin Core with a Tor daemon and set -whitelist to an IP range matching the Tor daemon, resulting in thousands of reachable mainnet nodes whitelisting all external inbound Tor connections. In the fixed versions, external Tor connections received via onion bindings are no longer whitelisted. The fix for this vulnerability is included in Bitcoin Core versions 28.3, 29.2 and 30.0.