Core Lightning Discloses Remotely Triggerable Node-Crash Vulnerability
A responsible disclosure showed that a remote peer could reliably crash vulnerable Core Lightning nodes that accepted inbound channels by sending an all-zero funding transaction ID during channel negotiation. The flaw threatened node availability rather than enabling theft of channel funds.
On May 29, 2026, a denial-of-service vulnerability affecting Core Lightning was publicly disclosed. The bug allowed a remote peer to crash a vulnerable node during the channel-opening handshake if the node accepted incoming channels.
During channel negotiation, the remote peer supplies the transaction ID of the proposed funding transaction. Core Lightning contained an assertion that expected this value to be non-zero. A malicious peer could instead send an all-zero transaction ID, causing the assertion to fail and terminating the process. Because an attacker could initiate the handshake remotely, the condition made vulnerable public nodes reliably crashable.
The vulnerability had been discovered by Chandra Pratap during a Summer of Bitcoin 2025 internship and disclosed responsibly before the public announcement. The issue was a denial-of-service flaw: the historical record should not imply that channel balances or private keys were stolen. Its consequence was loss of node availability and the operational burden of patching infrastructure exposed to incoming peers.
The event merits categorical inclusion because Lightning is significant Bitcoin payment infrastructure and the attack crossed the technical-proportionality threshold: it was remotely triggerable against real nodes rather than a theoretical or narrowly internal code-quality issue. Its normal importance reflects the absence of documented fund loss or a network-wide Lightning outage.