Bitcoin Core disclosed three security vulnerabilities on November 10, 2026, including a flaw that allowed unknown Tor connections to bypass network protections. Official security advisories said the issues affected node permissions, mining operations, and block processing, although fixes were released in October 2025.
The medium-severity vulnerability, identified as CVE-2025-62860, caused certain Bitcoin nodes to mistakenly classify external Tor connections as trusted. Bitcoin Core's whitelist configuration normally grants additional permissions to approved connections. However, Tor traffic appeared to originate from local software, allowing external users to inherit trusted privileges when local addresses were whitelisted.
Bitcoin Core noted that the flaw resulted in ‘thousands of reachable mainnet nodes whitelisting all incoming Tor connections.’ Researchers Martin Zumsande and Antoine Poinsot reported the issue in September 2025. Nodes without whitelist configurations were unaffected.
A second vulnerability, CVE-2025-62861, received a high-severity classification as it could disrupt mining operations. The flaw involved blockchain reorganizations, where transactions from discarded blocks return to the mempool.
Under certain conditions, Bitcoin Core could remove a transaction while retaining dependent transactions, producing invalid block templates. Affected mining nodes could become unable to construct valid blocks until restarted. Niklas Goegge reported the vulnerability on September 26, 2025. The advisory identified no confirmed exploitation.
The third vulnerability, CVE-2025-62859, was classified as medium severity and could delay block processing for approximately 10 minutes. An attacker controlling all three connections selected for fast block relay could repeatedly trigger the disruption, potentially preventing nodes from processing new blocks indefinitely.
The advisory also identified certain block-only configurations as vulnerable to repeated interruptions. These weaknesses primarily threatened network reliability rather than directly exposing Bitcoin wallet balances or private keys.
Although developers released patches in October 2025, detailed advisories appeared approximately 13 months later. According to Bitcoin Core's disclosure policy, medium- and high-severity vulnerabilities are generally published two weeks after the final affected software release loses support.
The affected 29.x release series reached that milestone on October 27, 2026. Node operators should install supported Bitcoin Core versions and review trusted connection settings to reduce exposure.
Also Read: Bitcoin Core Fixes 3 AI-Discovered Security Flaws Affecting Windows and Mac