Security· ★★★· neutral·

Eclair discloses two DoS vulnerabilities fixed in v0.14.1

  • —First flaw is a race condition in the duplicate temporary_channel_id check, leaking about 1 MB per second until memory runs out
  • —Second bypasses the pending-channel limit: a single connection exhausted 4 GB of node memory in about 48 minutes
  • —Both issues were fixed in Eclair #3324 and shipped in v0.14.1 in July 2025
  • —Mobile wallets using an Eclair node as LSP, including Phoenix, are unaffected as ACINQ patched its nodes earlier
Why it matters: Eclair node operators should upgrade to v0.14.1 immediately, as unpatched nodes can be memory-exhausted at no onchain cost to the attacker.
Source: Bitcoin Optech
More on this
Security · Sep 14
LDK releases v0.2.6 patch fixing two critical Lightning Network vulnerabilities
 Security · Oct 12
Eclair merges fixes for Lightning flaws that could burn Bitcoin in fees
 Security · 04:21
ChangeNOW Fixes Website Integration Vulnerability, Launches NOW AI Security Lab