Eclair 0.14 fixes two bugs that let any peer knock a node offline
Victoria Shinder2 min readTwo denial-of-service vulnerabilities in Eclair, ACINQ's Lightning Network implementation, were disclosed on Delving Bitcoin on 24 September by security researcher Matt Morehouse. Both are fixed in Eclair v0.14.0, and operators on v0.13.1 or earlier are advised to upgrade.
The first, LNF-2026-0001, sat in the handling of feature vectors - the bit fields Lightning nodes exchange in their opening init message to say which protocol features they support. Eclair parsed these one bit at a time and allocated several heap objects per bit. According to the disclosure, a single maximum-length init message caused roughly 300 MB of memory churn and tied up a parsing thread for up to 300 ms, and a flood of such messages could disconnect all of a victim's peers within a minute and exhaust its memory within five.
The second, LNF-2026-0002, involved channel gossip queries. Eclair still accepted zlib-compressed query_short_channel_ids messages four years after the BOLT 7 specification retired that encoding, and decompression had no output limit. A 64 KB message inflated to 64 MB and decoded into about 17 million heap objects; a stream of them could take a node offline within seconds.
How they were found is part of the story. The first came from Morehouse's fuzzer, smite, in its most basic scenario: send raw bytes as one message, then check that the target still answers a ping promptly. The second was not found by the fuzzer. After the first bug, he ran LLM-assisted variant analysis over the Eclair codebase, looking for other places where a peer could impose far more work on a node than it spends itself; the analysis flagged the zlib codec, and experiments confirmed it.
What it means
Both bugs share one shape: an unauthenticated peer sends a small input that costs the receiver orders of magnitude more to process. On a peer-to-peer network where anyone can open a connection, that asymmetry is the whole attack, and a Lightning node that goes offline cannot route payments or respond to channel disputes on time.
The second bug is also a reminder about deprecated features. An encoding removed from the specification four years ago was still accepted, still reachable, and still unbounded. Code paths that a protocol no longer needs are attack surface until they are deleted.