Bitcoin Core disclosed the medium-severity vulnerability CVE-2025-62859 on November 10, 2026. The advisory describes it as affecting versions before 29.2 and 30.0; fixes are included in both releases.
A malicious peer could tamper with witness data in a compact block and, under specific conditions, stall a victim node’s block processing. After reconstructing the compact block, the affected node clears its download state before checking the witness data. If that check fails, it requests the full block from the same peer and waits for a 10-minute timeout.
According to the advisory, an attacker could repeat the attack indefinitely if they control three of the victim’s high-bandwidth peers, or if the victim runs in -blockonly mode.
Original report: Odaily, published November 11, 2026, at 09:45:39 (UTC+8).