Unpatched Eclair Bitcoin Lightning nodes could crash again every time they restart
Summary
A flaw in Eclair, a Bitcoin Lightning implementation, let a malicious peer overwhelm reachable nodes running v0.14.0 or earlier by opening unfunded channels that were saved without paying an on-chain fee. In a regtest demonstration, the database grew to 217,623 records and a 4 GB Java heap was exhausted after about 48 minutes; saved records caused crashes to recur after restart. The issue was fixed in v0.14.1 before disclosure. A separate channel-opening race bug was also patched then. ACINQ recommends v0.14.3, which addresses additional vulnerabilities. The demonstration did not establish real-world exploitation or how many nodes remain vulnerable.
