On November 10, 2026, Bitcoin Core disclosed vulnerability CVE-2025-62860, revealing that thousands of mainnet nodes inadvertently granted incoming Tor connections exemptions from denial-of-service and privacy protections. The flaw occurred when node software was bundled with Tor using non-default whitelist settings matching the Tor daemon's IP address. While fixes shipped in October 2025 in releases 30.0, 29.2, and 28.3, detailed advisories were delayed 13 months until affected release branches reached end-of-life.
Story comments
Loading comments…