Core Lightning Acknowledges Multiple Security Bugs, Tells Node Operators to Prepare for Urgent Upgrade

Core Lightning has confirmed several security vulnerabilities in its Lightning Network implementation and is advising node operators to apply an upcoming security release as soon as it becomes available. Until the patch ships, the project recommends that operators who cannot upgrade immediately run their nodes with the "offline" option. This stops peer connections and disables incoming, outgoing, and routed Lightning payments, while keeping the daemon running to continue monitoring the Bitcoin blockchain. Developers said the issues surfaced while triaging a large batch of AI-generated CVE reports, a subset of which turned out to describe real, fix-worthy flaws. The team is not publishing technical details at this stage and is instead urging operators to prioritize the forthcoming security update. Core Lightning also explained why "offline" is preferred over shutting the node down entirely. With the daemon still running, the node can track the Bitcoin chain and react if a counterparty force-closes a channel. A fully stopped node cannot watch the chain; if a channel partner publishes force-close transactions while the node is down, the operator could miss the event and lose the ability to respond. After upgrading, operators must remove the "offline" flag, or the node will remain disconnected and normal Lightning activity will not resume. Key details remain undisclosed. Core Lightning has not published CVE identifiers, severity ratings, the affected components or versions, or any evidence of active exploitation. Operators will need to rely on the guidance included with the security release to determine whether their deployments are impacted. The newly confirmed bugs are separate from earlier denial-of-service issues disclosed this year involving memory exhaustion in connectd (peer handling) and gossipd (network gossip processing). Those DoS flaws allowed remote peers to trigger unbounded memory usage and were patched prior to the current warning. The broader context is familiar across Bitcoin and Lightning software, where occasional security releases require rapid operator action. The report points to recent high-profile fixes such as Bitcoin Core's CVE-2024-52911, a block validation issue addressed in Bitcoin Core 29.0, as well as past Lightning client incidents including LND's 0.16.3 memory leak in mid-2023 and replacement-cycling attack research published later that year. Practical guidance for operators: 1) Monitor Core Lightning channels for the security release and install it immediately once available. 2) If you cannot upgrade right away, restart Core Lightning with "offline" enabled to prevent connections and payment routing while keeping on-chain monitoring active. 3) Avoid fully stopping the daemon unless you understand and accept the risk of missing force-close events. 4) After applying the update, remove "offline" before restarting so the node can reconnect and resume normal payments and routing. Based on Core Lightning's disclosure so far, there have been no reported losses or confirmed successful attacks tied to these newly acknowledged vulnerabilities. Operators are still advised to treat the notice as urgent and use "offline" only as a temporary mitigation until the patched release is deployed.