A security disclosure has highlighted a persistent denial-of-service risk in older versions of Eclair, a software implementation of the Bitcoin Lightning Network. Reachable nodes running Eclair v0.14.0 or earlier could be overwhelmed by unfunded channel requests, even when an attacker did not broadcast a Bitcoin transaction or commit on-chain BTC.
The issue was fixed before it was publicly disclosed. Eclair v0.14.1, released in July, addressed the two denial-of-service flaws described in the disclosures. ACINQ, the organisation behind Eclair, now recommends operators use the later v0.14.3 security release because it fixes separate vulnerabilities.
How the attack worked
The Lightning Network uses payment channels to support transactions without recording every payment directly on the Bitcoin blockchain. Opening a channel normally involves a funding transaction, but the vulnerability concerned channel requests made before that funding step.
Eclair placed limits on the number of pending channels that a peer could request. However, checks involving temporary and final channel identifiers were inconsistent. That allowed a malicious peer to make the vulnerable node record more unfunded channel requests than intended.
The attacker did not need to pay an on-chain Bitcoin fee or broadcast the transaction that would normally fund the channels. The target still had to use network, memory and database resources to process and save the requests. The disclosure therefore concerns availability and resource exhaustion rather than a direct theft of funds.
Researcher Erick Cestari reported the persistent-crash finding on September 30 and discussed it alongside a separate denial-of-service flaw in an October 1 developer post. In a proof-of-concept test using Eclair v0.14.0 in regtest, Bitcoin’s local testing environment, the Java virtual machine exhausted a 4 GB heap after about 47 minutes and 43 seconds. The node’s channel database had accumulated 217,623 rows by that point.
That timing was a laboratory result, not a general estimate for every vulnerable installation. The demonstration also does not establish that the attack was being used against live nodes or indicate how many installations remained unpatched.
Why restarting did not solve the problem
A conventional restart might be expected to clear a temporary overload. In this case, however, the fake or unfunded channel records remained stored on disk after the initial crash. When the node started again, Eclair reloaded those records and exhausted memory once more.
As a result, repeated restarts could leave the underlying problem unchanged. Cestari identified increasing the available heap or manually deleting the malicious channel records as possible recovery measures. Those steps address an already overloaded database; they are different from preventing new unfunded-channel requests.
The second denial-of-service issue described in the same set of disclosures involved a race during channel opening. That flaw could leave orphaned channel processes consuming memory or CPU. The tested node recovered when the connection was closed or the node was restarted, without loss, according to the advisory. That recovery result applies to the channel-opening race and should not be treated as a solution to the persistent database-record problem.
ACINQ merged pull request #3324 on July 17, and Eclair v0.14.1 was released on July 29. The patch strengthened duplicate-channel checks. The disclosures, reported according to CryptoSlate, identify Eclair v0.14.0 and earlier as affected, while v0.14.1 and later address the two denial-of-service findings.
Patch status and current market picture
The July update is not the same as the latest security recommendation. ACINQ says operators should upgrade to Eclair v0.14.3, released September 14, because that version addresses separate vulnerabilities, including issues that could be exploited by malicious nodes. The source material does not establish whether an individual node has already been attacked, so patching status cannot be inferred from the disclosure alone.
Moneyiar market data at the stated times showed Bitcoin at $84,569.708439198, down 2.04% over 24 hours but up 0.67% over seven days, as of October 3, 2026, at 09:39 +03:30. Other listed assets were:
- Light (LIGHT): $0.1672899542, up 1.73% over 24 hours and down 9.4% over seven days, as of September 14, 2026, at 02:53 +03:30.
- FUNToken (FUN): $0.0083495993, up 1.29% over 24 hours and up 5.1% over seven days, as of October 3, 2026, at 09:39 +03:30.
- RedStone (RED): $0.1682997367, down 3% over 24 hours and down 0.66% over seven days, as of October 3, 2026, at 09:39 +03:30.
The security disclosures matter for Lightning operators because they separate two operational questions: stopping new resource-draining requests and recovering a node whose stored records have already become too large. Moving to the recommended release is the stated remediation from ACINQ; the findings do not provide a basis for assessing the security of any particular operator’s node.
