CVE-2025-62860

Name of the Vulnerable Software and Affected Versions Bitcoin Core versions prior to 30.0 Bitcoin Core versions prior to 29.2 Bitcoin Core versions prior to 28.3

Description Nodes using optional whitelist settings may incorrectly grant permissions to all incoming Tor peers if the configured IP ranges include Tor proxy servers. This occurs because Tor hands these connections over from a local address, causing the system to trust the connection via the -whitelist setting. This issue can bypass certain denial-of-service protections and weaken privacy protections for node operators. Thousands of mainnet nodes may have been affected.

Recommendations Update to version 30.0. Update to version 29.2. Update to version 28.3.