Core Lightning Urges Node Operators to Upgrade After Confirming Security Flaws

February 12, 2026 — Core Lightning has confirmed multiple security vulnerabilities in its Bitcoin Lightning Network software, prompting an urgent recommendation for node operators to install an upcoming security patch or temporarily run their nodes offline. The project identified the flaws after reviewing a large number of AI-generated Common Vulnerabilities and Exposures (CVE) reports, with several submissions revealing legitimate problems requiring fixes.

Immediate Details & Direct Quotes

Core Lightning announced Thursday that its developers had been reviewing AI-generated CVE submissions and confirmed that several identified real security issues. The project’s primary recommendation is for operators to upgrade once the patched software becomes available.

For operators who have not yet installed the security release, Core Lightning advised restarting the software with the `–offline` option. This configuration prevents the node from connecting to peers and stops payments from entering, leaving, or routing through it. The project initially described the offline setting as a protective measure while fixes were being prepared but later clarified that upgrading should be prioritized once the patched software is available.

Technical details about the newly confirmed vulnerabilities have not been made public. Core Lightning has not disclosed their severity, assigned public CVE identifiers, or reported evidence that attackers have exploited the flaws.

Running a node with the `–offline` setting allows the Core Lightning daemon to remain active while disconnecting from the Lightning Network. Under this configuration, a node does not accept incoming peer connections or attempt to reconnect with existing peers, preventing payments from moving through the affected node while the operator waits to install the security update.

Market Context & Reaction

Core Lightning emphasized that operators should not simply stop the software entirely. An active daemon running in offline mode can continue monitoring the Bitcoin blockchain and respond if another party force-closes a Lightning channel. A fully stopped node cannot perform the same monitoring while it remains offline, which is critical since channel counterparties can publish transactions to Bitcoin when channels are closed.

Once operators have installed the patched version, Core Lightning said they should remove the `–offline` option before restarting normally. Leaving the setting enabled after the upgrade would keep the node disconnected from its peers and prevent it from sending, receiving, or routing Lightning payments.

The project has not publicly described which components are affected or what conditions would be needed to exploit the confirmed flaws. Core Lightning also has not disclosed whether all supported software versions are affected, leaving operators dependent on the upgrade instructions accompanying the security release.

Background & Historical Context

The newly confirmed problems are separate from denial-of-service vulnerabilities disclosed earlier this year that could remotely crash Core Lightning nodes. Two related flaws involved memory exhaustion inside separate Core Lightning daemons. One affected `connectd`, the component handling peer connections, while another affected `gossipd`, which processes network information used by Lightning nodes.

In the `connectd` case, a remote peer could trigger unbounded memory use and eventually cause an out-of-memory crash. Another flaw allowed a remote peer to flood `gossipd` with channel update messages, causing an internal map used for unknown short channel IDs to continue consuming memory until the machine became unresponsive or crashed.

Security fixes requiring node operators to install updated software have also appeared elsewhere in Bitcoin infrastructure. In May, Bitcoin Core disclosed a bug tracked as CVE-2024-52911 that could allow miners to remotely crash vulnerable nodes. The issue affected Bitcoin Core releases after version 0.14.0 and before version 29.0, involving the script interpreter during block validation.

Lightning implementations have faced software-specific problems before. In June 2023, operators of Lightning Labs’ LND implementation were warned against upgrading to version 0.16.3 because of a memory leak that could eventually crash a node. Another Lightning security issue emerged later that year when developer Antoine Riard described replacement cycling attacks that could be used against Lightning payment channels.

What This Means

For the current Core Lightning vulnerabilities, operators have received protective instructions before technical disclosure of the underlying bugs. The project has confirmed several AI-generated CVE submissions were valid but has not published the affected functions, attack paths, or conditions needed to reproduce the issues.

No losses or successful attacks have been reported in connection with the newly confirmed flaws based on Core Lightning’s disclosure so far. Operators who have not yet upgraded were instructed to use `–offline` while keeping the daemon running, allowing the software to continue tracking Bitcoin for channel-related transactions without participating in Lightning payments.

After installing the security update, Core Lightning said operators using the temporary configuration must remove `–offline` to reconnect their nodes to peers and resume normal payment and routing activity. Node operators should monitor official Core Lightning channels for the security release and follow upgrade instructions carefully. This situation highlights the ongoing importance of maintaining updated software across Bitcoin infrastructure, as vulnerabilities continue to emerge across both Lightning implementations and core Bitcoin software.

—