CVE-2025-62860, medium-level threat. Connections coming through Tor were given trusted node permissions if the Tor daemon address was within the range set by the option
-whitelist. This removed some of the protection against node overload and information leakage. The option is not default, but popular providers bundled Bitcoin Core with Tor and set it themselves. As a result, thousands of available mainnet nodes accepted all Tor connections as trusted, writes the Bitcoin Core team. Patches include versions 30.0, 29.2 and 28.3. The bug’s discoverers, Martin Zumsande and Antoine Poinsot, also reported it to Bitcoin Knots maintainer, Luke Dashjr, in September 2025.