SECOND ECLAIR DENIAL-OF-SERVICE DISCLOSURE IN A WEEK — TWO BUGS FIXED IN V0.14.1 — ONE CONNECTION, AT NO ON-CHAIN COST, RAN A 4 GB NODE OUT OF MEMORY IN ABOUT 48 MINUTES — ONE BUG FOUND WITH AN LLM-BASED HARNESS

A disclosure posted to Delving Bitcoin on October 1, 2026 lays out two denial-of-service bugs in Eclair, ACINQ's Lightning node software. Eclair v0.14.0 and earlier are affected. Both are fixed in v0.14.1. It is the second Eclair disclosure in a week; the first, on September 24, covered two different bugs fixed in v0.14.0.

The first new bug is a race when a peer opens a channel. Exploited over and over, it makes the node leak about 1 MB a second until it runs out of memory and crashes. Matt Morehouse found it with his fuzzing tool, smite. The second gets around the node's limit on unfunded channel openings. Per the post: "A single connection, at no on-chain cost, ran a node with a 4 GB heap out of memory in about 48 minutes."

The author found that second bug with "an LLM-based harness." Same split as September 24: one bug from a fuzzer, one from AI. The post does not say funds were at risk. A node that keeps crashing still cannot route payments or keep an eye on its channels.

GitHub dates the v0.14.1 release July 29 and describes it only as "several bug fixes and performance improvements." The details came out two months later. That is how disclosure is supposed to work. It also means any node still on v0.14.0 is now running a bug the whole internet can read about. Check your version. At the time of this writing, bitcoin was $84,472.