Bitcoin Core disclosed a medium-severity vulnerability that could halt block processing, with fixes included in versions 29.2 and 30
According to the Bitcoin Core security announcement, the medium-severity vulnerability CVE-2025-62859 was disclosed on November 10, 2026. This vulnerability exists in versions prior to 29.2 and 30, where malicious nodes can exploit witness malleation in compact blocks to stall the block processing of victims under specific conditions.The announcement states that affected nodes will clear the download status after rebuilding the compact block and before checking the witness data. If the check fails, the node will revert to requesting the full block from the same node and wait for a 10-minute timeout. If the attacker controls three high-bandwidth peer nodes of the victim, or if the victim is running in -blockonly mode, this attack can be repeated indefinitely.This vulnerability was discovered and responsibly disclosed by Eugene Siegel, and the fix has been included in Bitcoin Core versions 29.2 and 30.
