Core Lightning has confirmed multiple security vulnerabilities in its Bitcoin Lightning Network software and has urged node operators to install an upcoming security update or temporarily run their nodes offline.
AI-Generated Security Reports Identified Real Flaws
Core Lightning said its developers had been reviewing a large number of AI-generated Common Vulnerabilities and Exposures reports and confirmed that several submissions identified real problems requiring fixes. The project advised operators to upgrade as its main recommendation. Operators who have not installed the security release can restart Core Lightning with the --offline option, which prevents the node from connecting to peers and stops payments from entering, leaving or routing through it.
Technical details about the newly confirmed vulnerabilities have not been made public. Core Lightning has not disclosed their severity, assigned public CVE identifiers or reported evidence that attackers have exploited the flaws. This security disclosure follows other crypto infrastructure vulnerabilities covered this year, including the Coldcard hardware wallet exploit that saw $114 million in Bitcoin stolen.
Core Lightning Nodes Can Remain Active Without Routing Payments
Using the --offline setting allows the Core Lightning daemon to remain active while disconnecting the node from the Lightning Network. Under the configuration, a node does not accept incoming peer connections or attempt to reconnect with existing peers. Payments therefore cannot move through the affected node while the operator waits to install the security update.
Core Lightning said operators should not simply stop the software because an active daemon can continue following the Bitcoin blockchain and respond if another party force-closes a Lightning channel. A fully stopped node cannot perform the same monitoring while it remains offline. Channel counterparties can publish transactions to Bitcoin when channels are closed, making continued blockchain monitoring part of normal Lightning node operations. Once operators have installed the patched version, they should remove the --offline option before restarting normally.
New Vulnerabilities Follow Earlier Denial-of-Service Fixes
The newly confirmed problems are separate from denial-of-service vulnerabilities disclosed earlier this year that could remotely crash Core Lightning nodes. Two related flaws involved memory exhaustion inside separate Core Lightning daemons. One affected connectd, the component handling peer connections, while another affected gossipd, which processes network information. In the connectd case, a remote peer could trigger unbounded memory use and eventually cause an out-of-memory crash. Another flaw allowed a remote peer to flood gossipd with channel update messages.
Security fixes requiring node operators to install updated software have also appeared elsewhere in Bitcoin infrastructure this year. Bitcoin Core disclosed a bug that could allow miners to remotely crash vulnerable nodes, tracked as CVE-2024-52911. Lightning implementations have faced software-specific problems before, including LND memory leaks and replacement cycling attacks described by developer Antoine Riard. These ongoing security challenges parallel the broader DeFi security concerns seen in the Term Finance $8.5M Meta Vaults attack.
