Bitcoin Core discloses Tor permissions flaw affecting thousands of nodes

The flaw arose when Tor connections appeared to Bitcoin Core as coming from the Tor software’s own IP address, typically on the same computer or local network. If that address matched a range set with the optional `-whitelist` setting, incoming connections received trusted-peer privileges. Those privileges remove some denial-of-service protections and safeguards against privacy leaks, the advisory said.

Popular vendors bundled Bitcoin Core with Tor and used matching whitelist ranges, leaving thousands of reachable mainnet nodes exposed to the configuration. Nodes without the non-default whitelist setting were unaffected. Martin Zumsande and Antoine Poinsot reported the issue to Bitcoin Core’s security team on Sept. 12, 2025. Developers merged Zumsande’s proposed fix on Sept. 17; Bitcoin Core 30.0 included it on Oct. 10, followed by 29.2 on Oct. 14. The advisory lists version 28.3 and later minor releases as patched.

The disclosure also covered two other bugs. CVE-2025-62861, rated high severity, affected versions 28.0 through 28.2 and 29.0 through 29.1. During a chain reorganization, a transaction replacement rule could remove a restored transaction while leaving dependent transactions in the mempool. That inconsistency could make a mining node’s block template fail validation, preventing further template creation until a restart. Niklas Goegge reported the issue on Sept. 26, 2025; developers merged a correction on Oct. 2.

CVE-2025-62859, a medium-severity compact-block flaw, could make a node wait through a 10-minute timeout after a peer’s altered transaction witness data failed a check. An attacker controlling all three of a victim’s high-bandwidth peers could repeat the delay indefinitely; nodes using `-blocksonly` could also be repeatedly stalled. Eugene Siegel reported it on April 28, 2025.

Bitcoin Core’s policy generally delays details of medium- and high-severity flaws until two weeks after the last affected release series reaches end of life. The 29.x series ended support on Oct. 27, before the disclosures were published.