Bitcoin Core publicly disclosed a medium-severity vulnerability, CVE-2025-62859, on November 10, 2026. The flaw allows a malicious node to stall block processing by exploiting witness malleation in compact blocks under specific conditions. Affected nodes clear their download state after reconstructing a compact block but before validating witness data. If validation fails, the node falls back to requesting the full block from the same peer and waits for a 10-minute timeout. An attacker controlling three of the victim's high-bandwidth peers—or operating against a node running in -blockonly mode—can repeat this attack indefinitely. The vulnerability was discovered and responsibly disclosed by Eugene Siegel. Fixes are included in Bitcoin Core versions 29.2 and 30.0.