A security flaw in Core Lightning, the popular software implementation for Bitcoin’s Lightning Network, can cause nodes to crash repeatedly upon restart even after operators install the latest software patches. According to researcher Nishant Bansal, the issue stems from a malformed channel announcement that remains stored on the node’s disk. While a fix was released in April to prevent new malicious inputs, it does not automatically purge existing bad data, leaving vulnerable installations prone to persistent failures unless specific records are manually deleted.

BTC / USD
Source: CoinGecko. Prices are indicative.

Persistent crash trigger in gossip store

Bansal disclosed the vulnerability on October 24, identifying versions v25.02 through v26.04 as affected. The flaw occurs when a node accepts a channel announcement that lists the same previously unknown node as both endpoints. Vulnerable software writes this malformed data to the on-disk gossip store before attempting to load it into the routing graph. During this process, the system attempts to insert the node twice, triggering a duplicate safeguard that aborts the gossipd component. Core Lightning treats this failure as fatal, causing the entire node to crash. Because the malicious record persists on disk, restarting the node reloads the same trigger, leading to an immediate crash.

According to Bansal, the April patch only rejects new incoming announcements by checking endpoint ordering. It does not scan or remove records already present in the gossip store. Consequently, operators who upgrade without manually removing the offending record will continue to experience crashes. Bitcoin Optech highlighted this discrepancy on October 30, noting that the preventive fix had been available since April 25, when Core Lightning shipped version v26.04.1.

Manual removal and ongoing risks

To resolve the issue, operators must manually identify and delete the malicious record from the gossip store. Simply upgrading the software is insufficient to restore stability. Furthermore, the disclosure indicates that an attacker can resend the same announcement as long as the attacker-controlled funding output remains unspent, meaning a vulnerable installation remains open to new attacks even after cleanup if not updated to a secure version.

Bitcoin Optech also noted that Core Lightning releases prior to v25.02 could accept and relay such announcements without crashing themselves. This allowed attackers to propagate the malicious data through the network without needing a direct connection to every vulnerable node, increasing the potential scope of the issue.

Financial risks of downtime

Beyond service unavailability, the prolonged downtime poses significant financial risks. Bansal warns that an offline node cannot monitor the blockchain for critical events, such as a revoked channel state or time-limited payment claims. If a node misses these events, it may fail to act within the required timeframe, potentially putting user funds at risk. As of November 2, the project’s latest release is v26.06.9, issued on October 7, which maintainers strongly recommend installing to ensure full protection against this defect.