Core Lightning: gossip announcement with identical node_id values crashes the node; fixed in v26.04.1
The disclosure describes Core Lightning versions v25.02–v26.04 crashing on receipt of a channel_announcement whose node_id_1 and node_id_2 identify the same node: gossipd does not check that the endpoints differ, triggering a duplicate assertion. The announcement is written to gossip_store before loading, so the crash repeats on every restart and the node stays offline until the operator manually removes the entry. All an attacker needs is a controlled, unspent 2-of-2 output, so the cost amounts to the on-chain fee. According to the disclosure, the fix was released in v26.04.1; the current release at the time of publication is v26.06.9.
Update Core Lightning to at least v26.04.1, preferably to the current release v26.06.9. If the node is already stuck in a startup crash loop, manually remove the problematic entry from gossip_store before starting it. Technical details and the release link are linked below.