Bitcoin Core Patches Medium-Severity Bug Affecting Block Processing

The Bitcoin Core development team has officially disclosed a medium-severity vulnerability labeled as CVE-2025-62859, which could allow malicious actors to stall block processing on the network. Disclosed on November 10, 2026, the flaw impacts nodes running versions prior to 29.2 and 30.0. The vulnerability involves a logic error in how compact blocks handle witness data, potentially leading to a denial-of-service (DoS) condition for affected participants in the peer-to-peer ecosystem.

Mechanism of the Compact Block Vulnerability

The security flaw stems from the way Bitcoin Core nodes manage witness data malleation during the reconstruction of compact block messages. According to the technical advisory, an affected node would clear its download status immediately after reconstructing a block but prior to the final verification of witness data.

If the witness data verification fails due to manipulation by a peer, the node is forced into a recovery state.

• The node reverts to requesting a full block from the same malicious peer.
• The system enters a 10-minute timeout period while waiting for the data.
• An attacker can repeat this cycle indefinitely, effectively preventing the victim from syncing with the latest blockchain state.

Compact blocks (BIP 152) are designed to reduce the bandwidth required to propagate new blocks by sending short transaction identifiers rather than full transaction data.

Exploitation Conditions and Responsible Disclosure

While the vulnerability is significant, it requires specific conditions to be successfully exploited. An attacker would need to control at least three high-bandwidth peer nodes connected to the victim to maintain the stall. Alternatively, nodes operating in -blockonly mode—a setting used to reduce bandwidth by not relaying individual transactions—are particularly susceptible to this stalling tactic.

The vulnerability was identified and responsibly reported by security researcher Eugene Siegel. By following responsible disclosure protocols, the developer allowed the Bitcoin Core team to integrate a fix into the codebase before the technical details were made public, minimizing the risk of widespread exploitation on the Bitcoin blockchain.

This attack can be repeated indefinitely if an attacker controls three high-bandwidth peer nodes of the victim, or if the victim is running in -blockonly mode.

To mitigate the risk of block processing stalls, node operators are encouraged to update their software to Bitcoin Core versions 29.2 or 30.0. These updates ensure that witness data verification is handled correctly before clearing download statuses, preventing malicious peers from triggering the 10-minute timeout loop. Staying current with core software releases remains a critical practice for maintaining the robustness and censorship resistance of the decentralized network.