 (CLN). Both vulnerabilities allowed a remote peer to trigger unbounded memory growth, ultimately leading to Out-of-Memory (OOM) system crashes.

. The second, related vulnerability affected the 

. Both vulnerabilities stem from work initiated during my 

 2025 internship. All node operators are strongly advised to ensure they are running the latest patched versions.

Core Lightning utilizes a multi-daemon architecture designed to isolate faults. The Lightning Network relies on a 

 to propagate network state, including channel announcements, channel updates, and node announcements.

) receives external messages from peers and passes them to the 

), which is responsible for managing the global view of the network. Because the network is inherently noisy, both daemons must operate with high efficiency. Furthermore, since they process untrusted external inputs, they must be robust against malicious message floods.

lightning

> *by* [**Chand-ra**](https://delvingbitcoin.org/u/chand-ra)
>
> ## Summary
>
> This post details two distinct [Denial-of-Service](https://en.wikipedia.org/wiki/Denial-of-service_attack) (DoS) vulnerabilities discovered in [Core Lightning](https://github.com/ElementsProject/lightning) (CLN). Both vulnerabilities allowed a remote peer to trigger unbounded memory growth, ultimately leading to Out-of-Memory (OOM) system crashes.
>
> The first vulnerability affected the `connectd` daemon and was patched in [release v26.04](https://github.com/ElementsProject/lightning/releases/tag/v26.04). The second, related vulnerability affected the `gossipd` daemon and has been patched in [release v26.06rc2](https://github.com/ElementsProject/lightning/releases/tag/v26.06rc2). Both vulnerabilities stem from work initiated during my [Summer of Bitcoin](https://www.summerofbitcoin.org/) 2025 internship. All node operators are strongly advised to ensure they are running the latest patched versions.
>
> ## Background
>
> Core Lightning utilizes a multi-daemon architecture designed to isolate faults. The Lightning Network relies on a [“gossip” protocol](https://github.com/lightning/bolts/blob/94eb038c42e664dd7862faeec6508ccd25f63ff8/07-routing-gossip.md) to propagate network state, including channel announcements, channel updates, and node announcements.
>
> In CLN’s architecture, the [connect daemon](https://github.com/ElementsProject/lightning/blob/bc3b9b4f116b5c5386c730d2d2654348a71dba26/connectd/connectd.c) (`connectd`) receives external messages from peers and passes them to the [gossip daemon](https://github.com/ElementsProject/lightning/blob/bc3b9b4f116b5c5386c730d2d2654348a71dba26/gossipd/gossipd.c) (`gossipd`), which is responsible for managing the global view of the network. Because the network is inherently noisy, both daemons must operate with high efficiency. Furthermore, since they process untrusted external inputs, they must be robust against malicious message floods.
>
> [**...read more at delvingbitcoin.org**](https://delvingbitcoin.org/t/vulnerability-disclosure-twin-memory-exhaustion-dos-vulnerabilities-in-core-lightning/2731)