Two DoS vulnerabilities in Eclair disclosed; fixed in version 0.14.0
In Eclair 0.13.1 and earlier, feature vectors were parsed bit by bit: one maximum-length init message generated about 300 MB of heap garbage and occupied the parsing thread for up to 300 ms (LNF-2026-0001). According to the researcher's description, a stream of such messages disconnects all the victim's peers within a minute and exhausts memory within five. The second issue (LNF-2026-0002) is that zlib-compressed channel queries are still accepted without an output size limit: a 64 KB query expands to 64 MB and around 17 million heap objects, and a stream of these messages takes the node offline in seconds. Both are fixed in Eclair 0.14.0.
Check your Eclair version now: if it is below 0.14.0, update to 0.14.0 or later during this maintenance window — until you update, any peer can crash your node and disconnect its channels. No action is required for anyone already on 0.14.3. Advisory details are at the links in the post.