Bitcoin Core reveals Tor flaw that trusted thousands of nodes - Crypto News

Bitcoin Core has disclosed a vulnerability that gave incoming Tor connections trusted permissions on thousands of nodes, removing some protections against spam and privacy leaks. The medium-severity flaw, identified as CVE-2025-62860, affected certain whitelist configurations and was patched in October 2025.

According to the security advisory published Nov. 10, developers released the details alongside two other vulnerabilities after the last affected release series, 29.x, reached the end of support on Oct. 27. The vulnerability allowed incoming Tor peers to appear under the IP address of the Tor software, which usually ran on the same computer or local network.

Whitelist settings bypassed

When that address matched a range configured through the optional -whitelist setting, outside connections received permissions intended for trusted peers. Whitelisting removes various denial-of-service limits and safeguards against leaking private information.

Popular vendors bundled Bitcoin Core with Tor and configured matching whitelist ranges, leaving thousands of reachable mainnet nodes accepting all incoming Tor connections with those privileges. Nodes that never enabled the non-default setting were unaffected by this flaw.

Mining vulnerability could halt blocks

A separate high-severity bug, tracked as CVE-2025-62861, affected versions 28.0 through 28.2 and 29.0 through 29.1. The issue occurred during chain reorganizations when transactions from disconnected blocks return to the mempool, the node's collection of pending transactions.

The bug left a transaction replacement rule active during that process, potentially removing a restored transaction while leaving behind dependent transactions. This could cause a mining node's proposed block template to fail its validity check, halting block template creation until a restart reloaded the mempool into a consistent state.

Third flaw causes processing delays

The third vulnerability, CVE-2025-62859, involved compact blocks, a bandwidth-saving method of relaying blocks between nodes. A malicious peer announcing a compact block first could cause a victim to request the full block from the same peer and wait through a 10-minute timeout following a failed check for altered transaction witness data.

According to the disclosure, an attacker controlling all three of a victim's high-bandwidth peers could repeat the disruption indefinitely. Nodes running with -blocksonly were another configuration in which repeated stalling was possible. Bitcoin Core's disclosure policy normally holds medium- and high-severity vulnerability details until two weeks after the last affected release reaches end of life.