Bitcoin Core Discloses Medium-Severity Vulnerability That Could Stall Block Processing
Bitcoin Core has disclosed a security vulnerability that could prevent affected nodes from processing new blocks under certain conditions. The flaw, identified as CVE-2025-62859, has been classified as medium severity and was fixed in Bitcoin Core 29.2 and 30.0.
The disclosure was published on November 10, 2026, following a responsible security report submitted by developer Eugene Siegel in April 2025.
How the Vulnerability Works
The vulnerability affects Bitcoin Core versions earlier than 29.2 and 30.0. It involves a process called compact block reconstruction, which allows Bitcoin nodes to receive and reconstruct blocks more efficiently without downloading all their transaction data from scratch.
The problem occurs when a malicious peer manipulates witness data in a compact block.
Affected nodes would clear their block download state before checking whether the reconstructed block contained manipulated witness data. If the check failed, the node would request the full block again from the same peer and wait for a timeout of up to 10 minutes.
This creates an opportunity for a malicious peer to delay block processing.
How an Attack Could Be Repeated
Under certain conditions, an attacker could repeatedly exploit this behavior to keep a victim’s node from processing blocks.
Bitcoin Core explains that this could happen if an attacker controlled all three of the victim’s high-bandwidth peers or if the victim operated its node using the -blocksonly configuration.
In these circumstances, the attack could be repeated indefinitely, potentially disrupting the node’s ability to process new blocks normally.
The vulnerability does not directly allow an attacker to steal Bitcoin or create coins outside Bitcoin’s issuance rules. Its primary impact is on node availability and block processing.
Vulnerability Timeline
The vulnerability was discovered and responsibly disclosed by Eugene Siegel.
April 28, 2025: Eugene Siegel reports the vulnerability to the Bitcoin Core security mailing list.
May 30, 2025: Gregory Sanders opens pull request #32646 to address the issue.
June 30, 2025: The proposed fix is merged.
September 12, 2025: The fix is backported to the Bitcoin Core 29 release branch.
October 10, 2025: Bitcoin Core 30.0 is released with the fix.
October 14, 2025: Bitcoin Core 29.2 is released with the fix.
October 27, 2026: The vulnerable 29.x release branch reaches end of life.
November 10, 2026: Bitcoin Core publicly discloses the vulnerability.
What Node Operators Should Do
Bitcoin Core has already released fixes for the vulnerability.
Node operators running affected versions should upgrade to Bitcoin Core 29.2 or later in the 29.x branch, or to Bitcoin Core 30.0 or later.
Keeping Bitcoin Core updated is an important part of maintaining node security, reliability, and network participation.
Why This Matters
Bitcoin’s resilience depends on thousands of independently operated nodes validating and relaying blocks across the network.
Although this vulnerability does not threaten Bitcoin’s monetary supply or directly compromise users’ funds, it highlights an important aspect of Bitcoin security: even when consensus rules remain intact, weaknesses in networking and block-processing software can affect individual nodes.
The disclosure also demonstrates the importance of responsible vulnerability reporting, coordinated fixes, and timely software updates in maintaining Bitcoin’s decentralized infrastructure.