Bitcoin Core's CVE-2025-62859 can leave a node repeatedly waiting for block data after a malicious peer announces a compact block first, putting block processing at risk in specific setups.
Bitcoin Core publicly disclosed the medium-severity flaw Nov. 10. It affects versions before the fixes in Bitcoin Core 29.2 and 30.0, according to the project's security advisory.
After reconstructing a compact block, a vulnerable node clears its download state before checking for witness malleation. If that check fails, it requests the block from the same peer through GETDATA; the request can time out after 10 minutes.
Bitcoin Core says the stalls could recur indefinitely if an attacker controls the victim node's three high-bandwidth peers, or if the node runs with the -blocksonly option. The advisory identifies no broader motive or economic beneficiary.
