Two DoS vulnerabilities in Eclair channel opening fixed in v0.14.1

Two issues have been found in the channel-opening flow in Eclair v0.14.0 and earlier. The first (LNF-2026-0003) is a race condition when checking for a duplicate temporary_channel_id: a stream of identical open_channel messages creates orphaned channel actors and a memory leak of roughly one megabyte per second, leading to a JVM OOM crash or a garbage-collection hang that takes the node offline. The second bypasses the pending-channel limiter by reusing the final channel id as a temporary one: a single connection, with no on-chain cost, exhausted 4 GB of heap in about 48 minutes, and because the channels are saved to disk, the node crashed again on every restart until manual cleanup or a heap increase. The attacks require only a connection to the node; the report provides no evidence of exploitation on the network.