Core Lightning released v26.06.10 fixing reported vulnerabilities in dual funding, splicing and onchaind HTLC resolution, and urged node operators to upgrade.
Key Facts
Core Lightning released version 26.06.10 with fixes for vulnerabilities responsibly reported by a number of researchers, and strongly recommended that users upgrade.
The fixes cover dual funding and splicing, onchaind HTLC resolution, gossip resource limits, connectd, runes and commando, plugin hooks and hsmd, plus several remote-crash and hardening fixes.
As with the two previous point releases, there is no embargo, and tests for the security fixes are temporarily withheld to make the fixes harder to turn into working exploits.
Core Lightning, a software implementation of Bitcoin's (BTC) Lightning Network, has released version 26.06.10 with fixes for several responsibly reported vulnerabilities, urging operators to upgrade.
The release, published on Wednesday on GitHub, follows 26.06.8 and 26.06.9 in shipping without an embargo period, meaning the fixes were available immediately.
"We strongly encourage everyone to upgrade to 26.06.10 as soon as practical," the maintainers wrote in the release notes.
Core Lightning urged node operators to upgrade to version 26.06.10 after fixing reported vulnerabilities. Source: CoinMarketCap
What the Release Fixes
The security fixes cover dual funding and splicing, including signature checks on a peer's transaction signatures, along with onchaind HTLC resolution, gossip resource limits, connectd, runes and commando, plugin hooks and hsmd. The release also includes several remote-crash and hardening fixes.
The maintainers have temporarily withheld tests for the security fixes "to make it harder to quickly turn the fixes into working exploits and to give users and network participants more time to upgrade before more technical detail is published."
They credited more than a dozen researchers and teams for reporting the issues, including The Bitcoin Red Team.
Notes for Node Operators
The release now refuses channel opens where a peer's dust limit exceeds 5,000 satoshis, and refuses dual-funded (v2) opens requesting zero-conf unless the node is configured to accept zero-conf channels from that peer, as standard opens already were. Dual funding remains experimental, and the maintainers discourage zero-conf channels with untrusted peers.
Because several fixes concern runes and commando, the maintainers advised operators to bind runes used over commando to the node that uses them and to rotate any they can't account for.
The release follows Bitcoin Core's move to fast-track fixes for bugs AI can easily find, skipping long embargoes, and Electrum's patch for a bug exploited by malicious servers. Core Lightning is one of several Lightning Network implementations.
