According to ChainCatcher citing a Bitcoin Core security advisory, medium-severity vulnerability CVE-2025-62859 was disclosed on November 10, 2026. It affects versions earlier than 29.2 and 30 and could allow a malicious node to stall block processing by manipulating witness data in compact blocks under certain conditions.
The affected node clears its download state after reconstructing a compact block but before checking its witness data. If that check fails, it requests the full block from the same peer and waits for a 10-minute timeout. The attack can be repeated indefinitely if an attacker controls three of the victim’s high-bandwidth peers or if the victim runs in -blockonly mode. Eugene Siegel discovered the vulnerability and responsibly disclosed it. The fix is included in Bitcoin Core versions 29.2 and 30.