A disclosed flaw in Core Lightning, software used on Bitcoin's Lightning payment network, can cause repeated crashes even after an upgrade. Researcher Nishant Bansal's disclosure on October 24 identifies v25.02 through v26.04 as the affected versions. A restart loads the stored malicious announcement again, triggering another crash. Bansal says operators must manually delete the malicious record to recover the node.
Core Lightning incorporated the preventive patch through PR #9082 on April 24. Core Lightning then released the fix in v26.04.1 on April 25, months before the October disclosure. Bitcoin Optech drew attention to the flaw on October 30.
Channel announcements describe connections within the Lightning routing graph. The malicious announcement designated one previously unknown node as both endpoints of a connection. Vulnerable versions accepted the announcement and saved the announcement in the on-disk gossip_store before adding the announcement to the routing graph. The graph attempted to add the same node twice. A duplicate-prevention safeguard terminated gossipd, the component responsible for processing these announcements. Core Lightning treated the gossipd failure as fatal and shut down the entire node.
The patch validates endpoint ordering before accepting an announcement. The check requires the first node ID to be strictly smaller than the second, excluding announcements with identical endpoint IDs. The check prevents malformed announcements from being accepted and saved. However, the validation applies to incoming announcements, while startup continues to load existing gossip_store records. An upgrade therefore leaves any malicious record stored before the crash in place.
Bansal says recovery requires removing the malicious record from gossip_store manually. However, deleting the record without upgrading leaves a vulnerable installation exposed to another crash. Bansal's disclosure says an attacker can send the announcement again as long as the funding output controlled by the attacker remains unspent. Bitcoin Optech says versions earlier than v25.02 could receive and forward these announcements without crashing. An attacker therefore did not require a direct connection to each vulnerable node.
Version v26.04.1 is the earliest release containing a fix for this flaw. As of November 2, v26.06.9 is the latest release, issued on October 7. Maintainers strongly recommend installing v26.06.9.
Downtime creates payment-monitoring risks in addition to making the service unavailable. Bansal warns that an offline node cannot monitor the blockchain for revoked channel states or payment claims with deadlines. A node that misses those events can put funds at risk.
Core Lightning Nodes May Crash After Upgrade Until Malicious Record Removed
CryptoSlateShare
Summary
A recent blockchain upgrade to Core Lightning software may cause node crashes due to a malicious record issue. The flaw impacts versions v25.02 through v26.04, where a bad channel announcement creates duplicate node entries. A fix was added in v26.04.1 on April 25, but old malicious records remain. Researchers say an attacker can retrigger the flaw if the funding output is unspent. Maintainers advise upgrading to v26.06.9 for protection. A network upgrade is recommended to avoid disruption.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.