Core Lightning confirms multiple vulnerabilities, prepares security update

Core Lightning, an open-source implementation of Bitcoin’s Lightning Network, has confirmed multiple vulnerabilities and urged node operators to install a forthcoming security update.

On Thursday, Core Lightning said it had been assessing a high volume of AI-generated Common Vulnerabilities and Exposures (CVE) reports and found that several are real. The project told operators not to shut down their nodes completely, but to restart them with “--offline,” which prevents payments from entering, leaving or routing through the node.

In a subsequent post, Core Lightning clarified that upgrading is its primary recommendation, while restarting with --offline is an alternative for operators who have not upgraded. 

The guidance gives operators an alternative for protecting their nodes until they upgrade, without shutting down the underlying software entirely. Core Lightning has not disclosed the nature or severity of the vulnerabilities, published CVE identifiers or reported any related exploitation or losses.

Core Lightning said keeping the daemon active allows it to follow the Bitcoin blockchain and respond if a counterparty force-closes a channel, which a stopped node cannot do. Operators using --offline were advised to remove it after upgrading or their nodes will remain disconnected.

The newly confirmed flaws are separate from remote denial-of-service vulnerabilities disclosed in May and July, which were patched in earlier releases. 

Related: StarkWare tests quantum-resistant Bitcoin transaction on mainnet