Vulnerability Disclosure: Twin Memory Exhaustion DoS Vulnerabilities in Core Lightning

This blog post delves into two critical Denial-of-Service vulnerabilities identified in Core Lightning, a significant component of the Lightning Network's infrastructure. These vulnerabilities were both exploitable by a remote peer and could lead to unbounded memory growth resulting in Out-of-Memory system crashes. The first vulnerability was localized within the connectd daemon and effectively addressed in release v26.04. Concurrently, a second flaw was pinpointed in the gossipd daemon, which underwent correction in release v26.06rc2.

Core Lightning employs a multi-daemon architecture to segregate functions and enhance fault isolation. Within this structure, connectd handles incoming messages from network peers and relays them to gossipd, which maintains the network’s global state. This setup is crucial for ensuring operational efficiency and robustness against potential floods of malicious messages. Both vulnerabilities discovered hinge on this inter-daemon communication and the handling of channel_update gossip messages.

The initial vulnerability in connectd was unearthed during a fuzzing initiative, part of a Summer of Bitcoin 2025 internship project. A specific fuzz target designed to test gossipd's state machines led to the discovery. Here, the bug allowed a high volume of incoming gossip messages to clog the message queue shared between connectd and gossipd, causing the system to run out of memory. The subsequent examination and fix involved modifying the message handling process to implement a cutoff after a certain number of messages, specifically 500,000, as detailed in the related Pull Request.

Ironically, while confirming the fix for the first issue, a second vulnerability emerged in gossipd. This flaw was similar in nature but involved an internal map used to track unknown short channel IDs (SCIDs). When gossipd received an unrecognized SCID, it would attempt to store these IDs for future queries, leading to uncontrolled growth in memory usage. This issue was inadvertently addressed through a patch initially intended to introduce a compaction mechanism for the gossip map. The patch facilitated automatic garbage collection when dead records outnumbered live ones by a significant margin.

These incidents underscore the importance of rigorously testing internal interfaces and handling external inputs with extreme caution. They also highlight the interconnected nature of software systems where vulnerabilities in one component can affect the entire architecture. Node operators are advised to update their systems to the latest releases to mitigate these risks and ensure network stability. Special acknowledgment goes to the mentorship and guidance provided during the internship, which was instrumental in identifying and resolving these security issues.