Bitcoin Core developers have published official security advisories for three system vulnerabilities after the version 29.x release branch officially reached its end of life on October 27, 2026. The disclosures detail two high-severity flaws and one medium-severity vulnerability, spanning Tor IP misidentification, miner block validation failures, and potential peer-to-peer data transmission delays.
Withholding technical details follows the developers’ official security policy, which only reveals vulnerability mechanics once affected versions pass their operational lifecycle.
Why Thousands of Nodes Granted Privileged Access to External Tor
The most widespread vulnerability is tracked under CVE-2025-62860. The issue stemmed from how Bitcoin Core handled incoming connections routed through the Tor network. The system recognized external onion connections using the IP address belonging to the local Tor software on the same machine. If that local address matched the optional -whitelist parameter range, external connections automatically inherited privileged, trusted status.
This accidental whitelisting stripped away critical system defenses. Once an external connection was deemed trusted, Bitcoin Core automatically disabled denial-of-service (DoS) defenses and privacy leak protections. The flaw affected thousands of mainnet nodes bundled by vendors with preconfigured Tor setups, leaving them to process external requests without standard security filters.
Researchers Martin Zumsande and Antoine Poinsot reported the Tor vulnerability on September 12, 2025. The development team resolved the issue by exempting onion connections from the whitelist parameter in Bitcoin Core versions 30.0, 29.2, and 28.3.
Chain Reorganizations and Block Validation Failures
The second high-severity vulnerability, tracked as CVE-2025-62861, was reported by Niklas Goegge on September 26, 2025. This bug affected node versions 28.0-28.2 and 29.0-29.1 within the version 3 transaction (TRUC) mechanism during chain reorganizations.
During a chain reorganization, transaction replacement rules in the mempool mistakenly evicted restored parent transactions while leaving their child transactions queued. These orphaned child transactions triggered block validation failures for miners, persisting until operators restarted their nodes.
Bitcoin Core developer Greg Sanders confirmed that a fix for the TRUC bypass logic was merged into the main codebase on October 2, 2025. Alongside this, the security report detailed CVE-2025-62859, a medium-severity vulnerability discovered by Eugene Siegel. This flaw allowed an attacker controlling three high-speed peers to force a victim node into a 10-minute timeout during compact block transmissions.
The Two-Week Post-Support Policy
Bitcoin Core’s official security disclosure policy requires withholding technical details for medium- and high-severity vulnerabilities until two weeks after the final affected release branch reaches its end of life. Because the 29.x branch officially retired on October 27, 2026, technical details for the three vulnerabilities were only then cleared for public release.
For node operators and miners, the disclosures establish a clear boundary: the 29.x series is no longer supported, making upgrades to the latest patched releases essential to mitigate attack vectors that are now publicly documented.
Originally reported by crypto.news.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
