Bitcoin Core discloses medium-severity vulnerability in block processing, fix included in versions 29.2 and 30.0
BIBIBI
AT A GLANCE
Bitcoin Core disclosed a medium-severity vulnerability that can stall node block processing under specific conditions, stating that 29.2 and 30.0 already include the fix.
Article
Bitcoin Core discloses medium-severity vulnerability that can stall block processing, fix included in versions 29.2 and 30.0
PANews November 11 message, according to the Bitcoin Core security advisory, the medium-severity vulnerability CVE-2025-62859 was disclosed on November 10, 2026. The vulnerability exists in versions before 29.2 and 30.0. A malicious node can exploit witness malleation in compact blocks to stall the victim's block processing under certain conditions. The advisory states that affected nodes clear the download state after reconstructing a compact block and before checking the witness data. If the check fails, the node falls back to requesting the full block from the same node and waits for a 10-minute timeout. If the attacker controls 3 of the victim's high-bandwidth peers, or the victim runs in -blockonly mode, the attack can be repeated indefinitely. The vulnerability was discovered and responsibly disclosed by Eugene Siegel, and the fix has been included...
(Click the link below to read the full article)
🔗 https://www.panewslab.com/zh/articles/01a1c844-94b0-76a9-ba01-97ec27a14d12
Key points
01
PANews, citing the Bitcoin Core security advisory, reported that the medium-severity vulnerability CVE-2025-62859 was disclosed on November 10, 2026.
02
The material states that the vulnerability exists in versions prior to 29.2 and 30.0, and that a malicious node could exploit witness data tampering in compact blocks to stall a victim's block processing under specific conditions.
03
Affected nodes clear the download state after reconstructing compact blocks and before checking witness data; if the check fails, they request the full block from the same node and wait for a 10-minute timeout.
04
The material states that if an attacker controls 3 of the victim's high-bandwidth peers, or the victim runs in -blockonly mode, the attack can be repeated indefinitely.
05
The vulnerability was discovered and responsibly disclosed by Eugene Siegel; the material's title states that the fix is included in versions 29.2 and 30.0.
AI-assisted interpretation
The following is analysis, separate from reported facts. Verify important claims independently.
This vulnerability involves the process by which a node receives and validates blocks: upon encountering tampered witness data, the node turns to request the full block from the same node and waits for a timeout. Under the specific conditions listed in the material, this process can occur repeatedly, causing block processing on the victim node to stall.
Why it matters to readers
Affected nodes may be unable to advance block processing normally, and under specific conditions the attack can be repeated. The material has listed the versions that include the fix, so the specific running version and attack conditions are the key points to verify.
First distinguish between "block processing stalling on affected nodes" and network-wide stalling: the material only describes the former. If running a Bitcoin Core node, you should check the version and fix information.
Risks and unknowns
The body text is truncated at the fix information; the complete fixed version information appears in the title, and the original security advisory still needs to be verified.
The material does not list the full range of affected versions, nor does it explain -blockonly mode.
The material does not provide evidence of actual exploitation, the number of affected nodes, or impact across the entire network.
Related Developments
Loading event timeline…
Related concepts
Compact block
This term is not in the glossary yet. Browse related concepts in the glossary.
