Core Lightning nodes can keep crashing after an upgrade until a stored trigger is removed
Summary
A malformed Lightning channel announcement can crash affected Core Lightning nodes and keep them from restarting because it remains in the local gossip store. Versions v25.02 through v26.04 are affected. A fix released in v26.04.1 rejects announcements that list the same node as both endpoints, but upgrading does not remove records already saved; operators must remove the offending record manually. Attackers may resend it while the associated funding output remains unspent. Node downtime can also prevent monitoring channel events, potentially putting funds at risk. The latest release cited is v26.06.9, which maintainers recommend installing.
