Bitcoin Core: Disclosed a medium-severity vulnerability that could stall block processing, with fixes included in versions 29.2 and 30

According to the Bitcoin Core security announcement, the medium-severity vulnerability CVE-2025-62859 was disclosed on November 10, 2026. This vulnerability exists in versions prior to 29.2 and 30, where malicious nodes can exploit witness malleation in compact blocks to stall the block processing of victims under specific conditions.

The announcement states that affected nodes will clear their download status after reconstructing the compact block and before checking the witness data. If the check fails, the node will revert to requesting the full block from the same node and wait for a 10-minute timeout. If an attacker controls three high-bandwidth peer nodes of the victim, or if the victim is running in -blockonly mode, this attack can be repeated indefinitely. The vulnerability was discovered and responsibly disclosed by Eugene Siegel, and the fix has been included in Bitcoin Core versions 29.2 and 30.