Bitcoin Core before versions 28.3, 29.2 and 30.0 will also include Tor inbound peers in a whitelist configured over an IP range.
This issue is considered Medium severity.
Details
In Bitcoin Core, the IP address of inbound Tor peers is that of the Tor daemon, which usually runs
on the same machine or local network. The -whitelist configuration lifts various DoS limits and
privacy leak mitigations for trusted peers. Bitcoin Core would whitelist inbound Tor connections if
the address of the Tor proxy would match the IP range configured via the -whitelist option.
Inbound Tor connections received on an onion bind are never whitelisted in Bitcoin Core 30.0 and all
later versions, as well as 28.3 and later minor versions and 29.2 and later minor versions. Nodes
that did not set the non-default -whitelist option were never affected.
Popular vendors bundled Bitcoin Core with a Tor daemon, and set the -whitelist option to an IP
range matching that of the Tor daemon. The -whitelist option was also an operational requirement
for client software of Bitcoin Core, which was commonly run alongside a Tor daemon. This led to
thousands of reachable mainnet nodes whitelisting all incoming Tor connections.
Attribution
Martin Zumsande and Antoine Poinsot discovered the issue and responsibly disclosed it.
Timeline
- 2025-09-12 Martin and Antoine report this issue to the Bitcoin Core security team
- 2025-09-15 Martin opens PR #33395 to stop considering Tor inbound peers when applying whitelist permissions
- 2025-09-17 Antoine reports this issue to Bitcoin Knots maintainer Luke Dashjr, who acknowledges it on the same day
- 2025-09-17 PR #33395 is merged and backported to previous releases
- 2025-09-19 Antoine reports this issue to several software providers affected
- 2025-10-10 Bitcoin Core 30.0 is released with a fix
- 2025-10-14 Bitcoin Core 29.2 is released with a fix
- 2025-10-20 Bitcoin Core 28.3 is released with a fix
- 2026-10-27 The last vulnerable Bitcoin Core version (29.x) goes end of life
- 2026-11-10 Public disclosure.