A newly disclosed denial-of-service vulnerability in Eclair, a Bitcoin Lightning implementation, allows a malicious peer to exhaust node memory and trigger repeated crashes without spending funds on-chain. Researcher Erick Cestari published the finding on September 30, detailing how unfunded channel requests accumulate in the node’s database, consuming resources until the Java virtual machine heap exhausts.
The attack exploits inconsistent validation of channel identifiers in Eclair v0.14.0 and earlier. Although ACINQ, the maintainer of Eclair, limited the number of pending channels a single peer could open, the implementation did not consistently check both temporary and final channel identifiers. A malicious peer could accumulate saved channel requests without broadcasting the funding transaction, bypassing the counter that was meant to prevent such abuse.
In a proof-of-concept test on regtest, the attacker exhausted a 4 GB Java heap in 47 minutes 43 seconds, accumulating 217,623 rows in the channel database. Once the node crashed, the channel records persisted on disk. During restart, Eclair reloaded the fake channels and exhausted memory again, leaving the node in a crash loop without manual intervention to remove the corrupted records.
ACINQ merged a patch addressing the persistent-crash vulnerability on July 17 as part of pull request #3324, and released Eclair v0.14.1 on July 29. According to Cestari, “v0.14.0 and earlier are affected, while v0.14.1 or later addresses these two denial-of-service findings.”
A second denial-of-service bug, identified by researcher Matt Morehouse of lnfuzz, involved a race condition during channel opening that left orphaned channel processes consuming memory or CPU. Both issues are patched in v0.14.1.
However, ACINQ recommends upgrading to v0.14.3, released on September 14, because that version also patches fund-loss vulnerabilities that could be exploited by malicious nodes. The distinction reflects separate security issues discovered across the Eclair codebase.
Cestari published a developer-focused post on the denial-of-service bug on October 1, expanding on the technical details of the vulnerability and the conditions under which nodes remain at risk.
