TechFlow reported on November 11, 2026, that a Bitcoin Core security announcement publicly disclosed the medium-severity vulnerability CVE-2025-62859 on November 10. A malicious node can tamper with witness data in a compact block and, under specific conditions, stall block processing on an affected node.
How the stall is triggered
The announcement states that when the tampering check fails, the affected node re-requests the block from the same peer and waits for a 10-minute timeout. The attack can be repeated indefinitely if the attacker controls three high-bandwidth peers of the victim node, or if the victim node is running in blocksonly mode.
Affected releases
The vulnerability affects versions before 29.2 and before 30.0. The releases that include the fix, 30.0 and 29.2, were published on October 10, 2025, and October 14, 2025, respectively.
The announcement limits the stall to the conditions above. It does not describe confirmed exploitation or effects beyond block processing on an affected node.
Original report by TechFlow, November 11, 2026.
