Disclosure: DoS vulnerabilities fixed in Eclair v0.14.0

It is highly recommended for users to update their nodes to this latest version to enhance security and stability. The first vulnerability, identified as LNF-2026-0001, involved an issue where the parsing of feature vectors was handled inefficiently. Specifically, each bit of the feature vector was processed individually, resulting in significant memory allocation and processing delays. This inefficiency could be exploited by sending a crafted init message containing a large feature vector, which would then cause approximately 300 MB of heap churn and occupy a parsing thread for about 300 milliseconds. Such an attack could lead to a disconnection of all peers of the victim within a minute and exhaust the node's memory in about five minutes.

The second vulnerability, documented as LNF-2026-0002, pertained to the handling of zlib-encoded channel queries which should have been phased out following updates to BOLT 7 four years prior. However, Eclair versions up to v0.13.1 continued to accept these encoded messages. The lack of an output limit during decompression meant that a 64 KB query_short_channel_ids message could expand to 64 MB, leading to the allocation of around 17 million heap objects. An attacker exploiting this vulnerability could incapacitate a node within seconds and deplete its memory resources shortly thereafter. This particular DoS vulnerability was uncovered following a comprehensive analysis conducted using LLM-assisted variant analysis techniques on the Eclair codebase after the discovery of the first vulnerability. This proactive approach helped in identifying other potential vulnerabilities, such as the faulty zlib codec, thereby preventing further exploits.

Both vulnerabilities highlight the importance of continuous monitoring and updating of software to guard against emerging threats. Users are urged to upgrade to Eclair v0.14.0 or later versions to mitigate these risks effectively.