Bitcoin Core Discloses Medium-Severity Vulnerability That Can Stall Block Processing; Fix Included in Versions 29.2 and 30.0

November 11: According to a Bitcoin Core security advisory, the medium-severity vulnerability CVE-2025-62859 was publicly disclosed on November 10, 2026. The flaw exists in versions prior to 29.2 and 30.0, and a malicious node can use witness malleation in compact blocks to stall the victim's block processing under certain conditions.

The advisory states that affected nodes clear their download state after reconstructing a compact block but before checking the witness data. If the check fails, the node falls back to requesting the full block from the same node and waits for a 10-minute timeout. If an attacker controls 3 of the victim's high-bandwidth peers, or the victim runs in -blockonly mode, the attack can be repeated indefinitely. The vulnerability was discovered and responsibly disclosed by Eugene Siegel, and the fix is included in Bitcoin Core versions 29.2 and 30.0.