A Bitcoin Core security advisory disclosed medium-severity vulnerability CVE-2025-62860 on November 10, 2026. According to PANews’ November 12 report, the flaw affects Bitcoin Core versions before 28.3, 29.2 and 30.0 in their respective release lines.
For an inbound connection made through Tor, Bitcoin Core sees the IP address of the local Tor software rather than the external peer. If that address falls within a trusted IP range configured with the non-default -whitelist option, Bitcoin Core can mistakenly whitelist the external connection. That removes the anti-DoS restrictions and privacy-leak mitigations normally applied to it.
The advisory says nodes that did not set a non-default -whitelist option were never affected.
Original report: PANews, published November 12, 2026, at 13:33 (UTC+8).