sec_₿sec.21ideas.org
core lightning · Delving Bitcoin
Patch availableNode operators24 October 2026

Core Lightning: gossip announcement with identical node_id values crashes the node; fixed in v26.04.1

The disclosure describes Core Lightning versions v25.02–v26.04 crashing on receipt of a channel_announcement whose node_id_1 and node_id_2 identify the same node: gossipd does not check that the endpoints differ, triggering a duplicate assertion. The announcement is written to gossip_store before loading, so the crash repeats on every restart and the node stays offline until the operator manually removes the entry. All an attacker needs is a controlled, unspent 2-of-2 output, so the cost amounts to the on-chain fee. According to the disclosure, the fix was released in v26.04.1; the current release at the time of publication is v26.06.9.

Actions to take

Update Core Lightning to at least v26.04.1, preferably to the current release v26.06.9. If the node is already stuck in a startup crash loop, manually remove the problematic entry from gossip_store before starting it. Technical details and the release link are linked below.