Core Lightning Discloses Two Memory-Exhaustion Denial-of-Service Vulnerabilities
Two denial-of-service vulnerabilities in Core Lightning were publicly disclosed after researchers found ways for remote peers to exhaust node memory through gossip-related data structures.
Bitcoin Optech’s July 31 newsletter summarized the public disclosure of two denial-of-service vulnerabilities discovered in Core Lightning during Summer of Bitcoin work. Both involved the interaction between Core Lightning’s gossip and connection-handling components. In one case, an attacker could flood a shared queue with channel-update messages until memory was exhausted. In the other, fake short-channel IDs could cause an internal tracking map to grow without effective bounds.
The bugs were not theoretical consensus attacks and did not steal funds. Their historical significance came from operational resilience: a remote peer could potentially crash a Lightning node by exhausting available memory. Developers addressed the problems by placing limits on message queues and improving garbage collection for the relevant data structures.
This is the kind of technical event that survives the timeline’s proportionality test because it affected functioning Bitcoin payment infrastructure rather than merely representing a routine version increment. Lightning depends on nodes remaining available and connected; remote resource-exhaustion paths therefore matter to the reliability of the network even when they do not compromise private keys or Bitcoin consensus.