eclair · Delving Bitcoin
DoS vulnerabilities disclosed in Eclair, fixed in version 0.14.1
A disclosure has been published for DoS vulnerabilities in the Lightning implementation Eclair; the fix was released in version 0.14.1. Operators of their own Eclair nodes are affected: denial of service means node unavailability and a risk of channels becoming inoperable. According to the source, users of mobile wallets that use an Eclair node as an LSP (such as Phoenix) are not affected — ACINQ patched its own nodes several months ago.
Actions to take
If you run your own Eclair node, update to 0.14.1 now, without waiting for a scheduled maintenance window; after updating, check that the node has started and channels are active. Disclosure details are linked below.
Source: delvingbitcoin.org