Two DoS vulnerabilities in Eclair channel opening fixed in v0.14.1
Two vulnerabilities have been disclosed in the channel-opening flow in Eclair v0.14.0 and earlier. The first (LNF-2026-0003) is a race condition when checking for duplicate temporary_channel_id values: pipelining identical open_channel messages creates orphaned channel actors, and a leak of about 1 MB per second leads to JVM OOM or a garbage collection spiral that takes the node offline. The second bypasses the limit on uncommitted channels by reusing a final channel ID as a temporary one: a single connection with no on-chain cost exhausted 4 GB of heap in about 48 minutes, and because channels are saved to disk, the node crashed again on every restart until the operator increased the heap or manually deleted records. Operators of Lightning nodes running Eclair are affected.
Update Eclair to v0.14.1 or later to protect against the described DoS attacks. The source describes repeated startup crashes caused by saved unfinished channels but does not provide a safe database cleanup procedure in this message. Do not manually delete channel records based on this brief announcement. Disclosure details are available at the links in the post.