Core Lightning releases 26.06.9: another set of security fixes and a fix for the gossip regression in 26.06.8

Patch release 26.06.9 fixes vulnerabilities in channel reestablishment, splicing, HTLC handling during closure, onion, onchaind, gossip queries, runes and setconfig, plus a number of remote crashes. It also fixes a 26.06.8 regression that caused a busy node to throttle ordinary gossip, pings and onion messages, and delay channel traffic. Again there is no embargo: the fixes are available immediately, while their tests are temporarily withheld to allow time for updates. Reproducible arm64 and armv7 builds are now available with separate signed manifests.

Actions to take

Update your Core Lightning node to 26.06.9 now, without waiting for a maintenance window — technical details of the vulnerabilities will become public later. Verify signatures and checksums against the manifest for your architecture. Note that a restricted rune no longer creates new runes without those restrictions or returns blacklisted ones in the list, and listconfigs now hides passwords and wallet paths — adjust your automation. Nodes that have run master builds cannot be downgraded to 26.06.x.

Source: github.com

Incident history

15 SeptCore Lightning investigates reports of a possible issue in experimental features that may affect funds
15 SeptStart9 identifies the specific experimental Core Lightning feature to disable on StartOS: dual funding and liquidity ads
22 SeptCore Lightning releases 26.06.8 with vulnerability fixes; no embargo, update available immediately
02 OctCore Lightning reports receiving reports of attacks on unpatched nodes running 26.06.7 and earlier
07 OctCore Lightning releases 26.06.9: another set of security fixes and a fix for the gossip regression in 26.06.8
07 OctCore Lightning: 26.06.9 fixes a vulnerability that could lead to loss of funds
07 OctCore Lightning fix reaches BTCPay Server: bundled version now 26.06.9
07 OctCore Lightning fix reaches StartOS: update already available in Marketplace