Eclair issues successive security fixes for splicing and payment handling
Three October releases addressed related weaknesses in channel changes, forwarding and settlement, culminating in more restrictive handling of splice inputs.
Eclair's October security sequence began with version 0.14.4 on October 15, 2026, followed by 0.14.5 on October 20 and 0.14.6 on October 27. The releases addressed weaknesses involving splicing, HTLC settlement and forwarding, onion parsing, API-origin handling and funding fees.
Splicing changes the funds committed to an existing Lightning channel while preserving its continuity. That convenience creates additional state transitions: software must track which funding transaction and payment commitments remain safe when a splice is incomplete or interacts with other operations.
The later releases addressed further trampoline-forwarding and taproot-splicing issues. Version 0.14.6 hardened unconfirmed-splice behavior and made confirmed splice inputs the default requirement.
The sequence showed remediation developing across several releases rather than a single announcement resolving every related problem. Each version changed the available software; none established universal deployment or proved that all possible failures in the affected mechanisms had been eliminated.
Together, the releases recorded the operational security work required to make more flexible channel management safe under adversarial and incomplete transaction states.