Eclair discloses two fixed channel-opening denial-of-service flaws
Researchers explained vulnerabilities corrected in Eclair 0.14.1, exposing how malicious channel-opening behavior could disrupt a Lightning implementation.
On October 1, 2026, researchers publicly disclosed two denial-of-service vulnerabilities fixed in Eclair version 0.14.1. The flaws involved channel opening, the process through which Lightning peers establish the state and funding arrangements needed to transact off-chain.
Opening a channel requires software to handle messages and commitments from another participant. A malicious peer can exploit mistakes in that process even before the resulting channel becomes a useful payment route. The disclosed issues therefore concerned the robustness of an implementation's interaction with counterparties.
The public explanation followed the fixes. It did not establish that the flaws had been exploited to steal bitcoin, and denial of service should not be confused with a successful claim on another user's funds.
The disclosure added to the documented security history of Lightning's channel-establishment machinery: a failure in software managing the protocol could disrupt service even when the underlying Bitcoin transactions and signatures remained valid.