Bitcoin Core Discloses Medium-Severity Vulnerability in Tor Connection Whitelist

On November 11, according to The Block, Bitcoin Core disclosed a fixed medium-severity vulnerability that could allow nodes with specific configurations to incorrectly whitelist inbound Tor connections.

Numbered CVE-2025-62860, the vulnerability affects nodes that have the optional whitelisting setting enabled and whose IP ranges include Tor proxies. Bitcoin Core stated that thousands of connectable mainnet nodes had previously whitelisted inbound Tor connections, causing some Denial-of-Service restrictions and privacy protections to fail.

Fixes were included in Bitcoin Core 30.0 and 29.2 in October 2025 respectively. Two other vulnerabilities disclosed at the same time involve block processing and mining node block template creation, which TechFlow has previously reported separately.