Core Lightning Nodes Keep Crashing Unless Stored Triggers Are Manually Removed

Operators running Bitcoin payment network software face ongoing crashes even after updating their setup, as researchers highlight lingering disk records. A disclosed vulnerability in the Core Lightning (CLN) implementation affects versions spanning from v25.02 up to v26.04. Once a malicious channel announcement is written to the local gossip store, restarting the software reloads the identical trigger, causing continuous failure.

Understanding the Core Lightning Issue

The root cause originates from how routing graph announcements are handled. Malformed data naming identical node IDs as both endpoints bypassed validation checks in vulnerable software versions. When the routing graph attempted duplicate insertions, the gossip daemon aborted, triggering a fatal shutdown of the entire node. Although preventive patches merged into pull requests in April and shipped in version v26.04.1, the update only guards against incoming traffic and fails to scrub previously saved records from disk.

Upgraded Core Lightning nodes continue crashing until operators manually purge saved malicious announcements.

Investigating researcher Nishant Bansal noted that cleanup alone leaves installations exposed if attackers resend identical announcements while the funding output remains unspent. Older releases prior to v25.02 could safely process and relay similar announcements without crashing, meaning attackers did not require direct connections to targeted infrastructure.

Why it matters

For node operators, unexpected downtime carries severe risks beyond mere service interruption. Offline infrastructure cannot monitor the blockchain for revoked channel states or time-sensitive payment claims that require broadcasting before expiration. Missing these vital window events can place user funds directly at risk, making timely manual intervention and maintenance essential for network security.