Bitcoin Core disclosed a medium-severity vulnerability, CVE-2025-62860, which was made public on November 10, 2026

Odaily reports that according to Bitcoin Core monitoring, the medium-severity vulnerability CVE-2025-62860 was publicly disclosed on November 10, 2026. The vulnerability exists in versions prior to 28.3, 29.2, and 30.0. Because connections made externally via Tor have IP addresses that are actually the addresses of the local Tor software, if such an address matches a trusted IP range configured through the -whitelist option, Bitcoin Core will incorrectly add these external Tor connections to the whitelist, thereby removing various anti-DoS restrictions and privacy leak mitigation measures for trusted nodes. The advisory noted that nodes that did not set the non-default -whitelist option were never affected.