CVE-2025-62860
AI description
CVE-2025-62860 is a vulnerability in Bitcoin Core that affects nodes configured with the non-default `-whitelist` setting alongside the Tor anonymity network. When a whitelisted network range covers the IP address of a local Tor proxy, incoming external connections arriving through Tor can be incorrectly classified as trusted. This occurs because the incoming Tor connections appear to originate from the local Tor software's IP address, matching the trusted range specified by the node operator. As a result, these untrusted incoming connections are mistakenly granted whitelist privileges. By gaining whitelist status, these incoming Tor connections bypass standard denial-of-service (DoS) protections and relax privacy safeguards designed to prevent node information leaks. While nodes without the custom `-whitelist` configuration were unaffected, thousands of reachable mainnet nodes were impacted because popular vendors frequently bundled Bitcoin Core with a Tor daemon and configured the whitelist option to match the daemon's IP range. The issue affected Bitcoin Core versions prior to 28.3, 29.2, and 30.0, and has since been resolved in subsequent releases.
- Description
- -
Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.
- Hype score
2
Bitcoin Core divulgó tres vulnerabilidades que llevaba más de un año parcheadas en silencio. La más incómoda: CVE-2025-62860. Las conexiones entrantes por Tor recibían permisos de -whitelist por error. Miles de nodos levantaron sus protecciones de DoS y privacidad para cua
@SergioTheNomad
12 Nov 2026
169 Impressions
0 Retweets
2 Likes
0 Bookmarks
0 Replies
0 Quotes
Bitcoin Core disclosed a Tor bug (CVE-2025-62860): some nodes treated every inbound Tor connection as a trusted peer. It was patched in October 2025. Running an older node over Tor? Update it.
@SatoshiDropsHQ
12 Nov 2026
347 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
@SoSoValueCrypto According to the Bitcoin Core security advisory, the medium-severity vulnerability CVE-2025-62860 was disclosed on November 10, 2026. The vulnerability exists in versions prior to 28.3, 29.2, and 30.0. Due to incoming connections via Tor from external sources,
@Kimjh102709
12 Nov 2026
147 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Thousands of Bitcoin nodes treated every incoming Tor connection as a trusted peer. Bitcoin Core disclosed the bug yesterday (CVE-2025-62860). Some node bundles set -whitelist to an IP range that covered their own Tor daemon. Every Tor peer arrives from that address, so all of
@BITCOIN_SAT0SHI
11 Nov 2026
216 Impressions
0 Retweets
1 Like
0 Bookmarks
1 Reply
0 Quotes
🔥Bitcoin Core fixed three security flaws, including one high-severity bug (CVE-2025-62861) that could halt mining by corrupting a node’s mempool. Two other vulnerabilities (CVE-2025-62859 and CVE-2025-62860) involved block processing delays and privacy issues over Tor
@NewsBlockCrypto
11 Nov 2026
9 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Bitcoin Core disclosed CVE-2025-62860: nodes that trusted an address range with -whitelist could end up trusting every incoming Tor peer, because Tor hands those connections over from a local address. Fixed in 30.0, 29.2 and 28.3 in Oct 2025. #Bitcoin https://t.co/Dm4oWQr9X9
@nvee3
11 Nov 2026
155 Impressions
0 Retweets
2 Likes
0 Bookmarks
0 Replies
0 Quotes
🚨 Bitcoin Core fixed a Tor-related vulnerability that could weaken node privacy and DoS protection. On November 11, Bitcoin Core disclosed a medium-severity vulnerability tracked as CVE-2025-62860. The bug affected nodes using optional whitelist settings when their configure
@Brainrot_Labs
11 Nov 2026
674 Impressions
2 Retweets
47 Likes
0 Bookmarks
39 Replies
0 Quotes
CVE-2025-62860 - Inbound Tor connections wrongly receive -whitelist permissions by ch0k1 in ~news, ~bitcoin 425 sats and 0 comments so far https://t.co/KiTNC2cXE5
@stacker_news
11 Nov 2026
316 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Update to version 30.0 now to fix three Bitcoin Core vulnerabilities, including CVE-2025-62861, CVE-2025-62860, and CVE-2025-62859 affecting nodes. #BitcoinCore #Bitcoin #BlockchainSecurity #Cybersecurity #InfoSec https://t.co/nwzenckRG6
@Daily_CyberSec
10 Nov 2026
402 Impressions
1 Retweet
1 Like
0 Bookmarks
0 Replies
0 Quotes