Bitcoin Core disclosed a fixed, medium-severity vulnerability that could cause nodes with a specific optional whitelist configuration to grant whitelist privileges to incoming Tor connections. TechFlow reported the disclosure on November 11, 2026, citing The Block.
The flaw, CVE-2025-62860, affected nodes whose configured whitelist IP range included their Tor proxy. Bitcoin Core said thousands of reachable mainnet nodes had whitelisted incoming Tor connections, disabling some denial-of-service limits and privacy protections for those connections.
Fixes were included in Bitcoin Core 30.0 and 29.2 in October 2025. TechFlow also noted that two other vulnerabilities disclosed around the same time concerned block processing and the creation of block templates by mining nodes; it had reported on those separately.
Original TechFlow report ยท Published November 11, 2026, at 20:52 (UTC+8).