Bitcoin Core Discloses Bug That Could Repeatedly Stall Block Processing

Bitcoin Core disclosed a medium-severity vulnerability on Nov. 10 that could repeatedly delay block processing on affected nodes, with each failed block request causing a 10-minute wait.

The flaw, CVE-2025-62859, affected versions before fixes in Bitcoin Core 29.2 and 30.0. A malicious peer could alter witness data in a compact block. After rebuilding the block, a vulnerable node cleared its download state before checking that data. If validation failed, the node requested the full block from the same peer and waited for a timeout.

The delay could repeat indefinitely if an attacker controlled all three of the target’s high-bandwidth peers or if the target ran with the -blocksonly option. Eugene Siegel discovered the flaw and responsibly disclosed it.