On November 10, 2026, a medium-severity vulnerability, CVE-2025-62859, was made public, according to a Bitcoin Core security announcement reported by ChainCatcher on November 11, 2026. The flaw is present in versions before 29.2 and 30. A malicious node can use witness malleation—tampering with witness data in a compact block—to stall a victim node’s block processing under specific conditions.
Mechanism described in the announcement
Affected nodes clear download state after reconstructing a compact block and before checking the witness data. If the check fails, the node falls back to requesting the full block from the same peer and waits for a 10-minute timeout.
When the stall can continue
The announcement states that the attack can be repeated indefinitely if the attacker controls the victim’s three high-bandwidth peers, or if the victim is running in -blockonly mode.
Disclosure and the versions that include the fix
Eugene Siegel discovered the vulnerability and disclosed it responsibly. The fix is included in Bitcoin Core 29.2 and 30. The reported effect is limited to stalling the victim node’s block processing under the conditions above.
