Bitcoin Core disclosed a medium-severity flaw that gave incoming Tor connections trusted permissions on thousands of nodes. The developers published it with two other vulnerabilities, one rated high severity, after the last affected release series reached end of support.
Bitcoin Core disclosed a vulnerability that granted incoming Tor connections permissions meant for trusted peers on thousands of reachable nodes. The flaw, tracked as CVE-2025-62860, removed some protections against spam and privacy leaks. Developers published the details on Nov. 10, after the 29.x series reached end of support on Oct. 27.
Whitelist settings let Tor traffic bypass limits
Incoming Tor peers appeared to Bitcoin Core under the IP address of the Tor software, which usually ran on the same computer or local network. When that address matched a range set through the optional -whitelist setting, outside connections received trusted-peer permissions. Whitelisting removes various denial-of-service limits and safeguards against leaking private information.
Popular vendors bundled Bitcoin Core with Tor and configured matching whitelist ranges, the developers said. Nodes that never enabled the non-default setting were unaffected.
Martin Zumsande and Antoine Poinsot reported the flaw on Sept. 12, 2025. Zumsande's fix excluded incoming onion connections from whitelist permissions, and developers merged it on Sept. 17, 2025. Bitcoin Core 30.0 shipped with the fix on Oct. 10, followed by 29.2 on Oct. 14.
A mining bug could halt block template creation
The second flaw, CVE-2025-62861, received a high-severity rating. It affected versions 28.0 through 28.2 and 29.0 through 29.1.
The problem arose during chain reorganizations, when transactions from disconnected blocks return to the mempool. The bug left a transaction replacement rule active during that process, so it could remove a restored transaction while leaving behind transactions that depended on it. According to the advisory, a mining node's proposed block template would then fail its validity check until a restart reloaded the mempool.
Compact blocks open a third delay
The third advisory, CVE-2025-62859, describes a medium-severity vulnerability involving compact blocks. A malicious peer announcing a compact block first could make a victim wait through a 10-minute timeout for the full block.
According to the disclosure, an attacker controlling all three of a victim's high-bandwidth peers could repeat the disruption indefinitely. Operators running a node with -blocksonly were another configuration where repeated stalling was possible.
Source: crypto.news
Trading involves risk.
Risk Disclaimer
