Bitcoin Core disclosed a medium-risk vulnerability, CVE-2025-62859, which has been patched in versions 29.2 and 30.0.

A Bitcoin Core security bulletin reveals a medium-risk vulnerability, CVE-2025-62859, disclosed on November 10, 2026. This vulnerability exists in versions prior to 29.2 and 30.0. Malicious nodes could exploit this vulnerability to tamper with witness data within compact blocks, potentially halting block processing for a victim under certain conditions. Affected nodes clear their download state after rebuilding a compact block but before checking the witness data. If the check fails, the node falls back to requesting a complete block from the same node and waits for a 10-minute timeout. This attack can be repeated indefinitely if the attacker controls three of the victim's high-bandwidth peer nodes, or if the victim is running in -blockonly mode.