Core Lightning patches critical security flaws and a Bitcoin payment bug

Core Lightning, a popular application for operating Bitcoin Lightning payment nodes, has rolled out version v26.06.9. This update includes important security corrections along with a fix for a regression that had the potential to slow down channel traffic on active nodes running version v26.06.8.

According to GitHub, the new software version went live on Oct. 7, whereas its versioned changelog lists the date as Oct. 6.

This fresh release provides operators who previously installed v26.06.8 with another opportunity to upgrade, coming on the heels of the Sept. 27 revoked-channel penalty vulnerability patched in v26.06.7. The newest software package implements security patches and resolves a regression that originated from that previous update.

Bitcoin payment delays and shutdown risk

Maintainers noted that in v26.06.8, routine network gossip, pings, and onion messages were incorrectly counted against a CPU budget originally meant exclusively for gossip queries. On high-traffic nodes, this faulty accounting could throttle peers and cause delays in channel traffic.

Version v26.06.9 properly allocates that CPU budget solely for gossip queries, ensuring standard messages no longer tap into it and eliminating the documented trigger for this throttling behavior. The regression highlighted by maintainers specifically impacts busy nodes operating on Core Lightning v26.06.8.

Additionally, the changelog outlines a resolution for payment contracts (HTLCs) that hit their expiration deadline simultaneously with a channel shutdown. In such scenarios, v26.06.9 now triggers a forced channel closure, stopping forwarded funds from disappearing if the payment finishes processing late.

For any operator who forwards payments, this remedies a vital funds-protection challenge whenever payment deadlines and channel closures happen at the same time.

Further improvements enforce strict boundaries on limits associated with runes utilized for authorizing calls. Consequently, a restricted rune can no longer generate an unrestricted variant or restore blacklisted runes. Limitations on related creation and blocklisting functions now properly extend to the invokerune and destroyrune aliases as well.

The listconfigs command now successfully hides multiple confidential entries—such as Bitcoin RPC passwords and recovery details—from every caller. Meanwhile, the setconfig command plugs a vulnerability that previously allowed configuration lines to be injected via persistent option values.

While these patches are accessible right away, maintainers have chosen to temporarily withhold associated security tests to complicate potential exploit creation and grant operators extra time to perform upgrades.

Nodes that have previously executed the master branch are unable to downgrade to any 26.06.x release because they utilize a newer database schema. Furthermore, the release notes remind users that dual funding is still in an experimental phase and advise against utilizing zero-confirmation channels with untrusted peers.

Maintainers strongly encourage all Core Lightning operators, including individuals currently running v26.06.8, to update their software to v26.06.9 at the earliest opportunity.

?Frequently Asked Questions

01What is Core Lightning v26.06.9?

Core Lightning v26.06.9 is a software release for Bitcoin Lightning payment nodes that introduces crucial security fixes and resolves a performance regression affecting busy nodes on version v26.06.8.

02Why did v26.06.8 cause channel traffic delays?

In version v26.06.8, standard operational messages like pings and gossip were improperly counted against a CPU budget reserved for gossip queries, resulting in peer throttling on busy nodes.

03Can nodes running the master branch downgrade to v26.06.9?

No, nodes that have run master cannot downgrade to any 26.06.x release because their underlying database schema is newer.