A PING COULD CRASH YOUR LIGHTNING NODE — PATCHED, DISCLOSED, HANDLED — BUT DOCKER USERS GOT THE LABEL WITHOUT THE MEDICINE
A version number is a claim. A digest is a fact. This week the two disagreed.
This week’s Bitcoin Optech newsletter carries the write-up every node runner should read. Any stranger who completed the encrypted handshake with an older Core Lightning node — no payment channel needed — could flood it with maximum-size ping requests, never read the replies, and crash the node out of memory. Responsibly disclosed, fixed in release 25.09, and rolled into the 26.06.7 security release, with the source code held back 14 days so attackers can’t reverse-engineer the fix while people upgrade. LND shipped the same class of armor this week: rate limits on pings, capped message queues. So far, the system working as designed. The trap is in the shipping: Docker users who pulled the fixed version between Aug 28 and Sept 1 got images that REPORT the new version number but do not contain the fixes. The label said medicine; the bottle was old. If you run CLN in Docker, check your image digest and pull again. The Technologist’s rule was never just “run current.” It’s run current, then verify what you’re actually running.
KEY RECEIPTS
The bug: ping messages requesting max-size (65,531-byte) replies, sender never reads the socket, node crashes out of memory. Attacker needs only the BOLT8 handshake — no channel (disclosure by Erick Cestari, Delving Bitcoin, via Optech #421).
The fix: Core Lightning #8525, shipped in release 25.09; also covered by the 26.06.7 security release (several disclosed vulnerabilities, none known to be exploited).
Source code withheld 14 days from the Aug 28 binary release to slow reverse engineering; reproducible builds let users verify after.
The Docker trap: images pulled under the v26.06.7 or latest tags between Aug 28 and Sept 1 reported the new version WITHOUT the fixes. Check the digest, re-pull.
LND’s parallel hardening (v0.21.3 / v0.20.4): inbound pings limited to a 200-token bucket refilling 10/second, outbound replies capped, per-peer queues capped at 10,000 messages / ~16 MiB.
Also in #421: a proposal to pay miners via silent payments in the coinbase (privacy for pool payouts), and the post-quantum output-type debate continues.
The fix: Core Lightning #8525, shipped in release 25.09; also covered by the 26.06.7 security release (several disclosed vulnerabilities, none known to be exploited).
Source code withheld 14 days from the Aug 28 binary release to slow reverse engineering; reproducible builds let users verify after.
The Docker trap: images pulled under the v26.06.7 or latest tags between Aug 28 and Sept 1 reported the new version WITHOUT the fixes. Check the digest, re-pull.
LND’s parallel hardening (v0.21.3 / v0.20.4): inbound pings limited to a 200-token bucket refilling 10/second, outbound replies capped, per-peer queues capped at 10,000 messages / ~16 MiB.
Also in #421: a proposal to pay miners via silent payments in the coinbase (privacy for pool payouts), and the post-quantum output-type debate continues.
Run current. Verify what you run.
Tick tock. Next block.
Tick tock. Next block.
Bitcoin Optech Newsletter #421 · Fri Sep 4 2026