Core Lightning 26.06.10 fixes dual-funding, splicing, runes/commando and remote-crash vulnerabilities

Summary

Core Lightning (CLN) 26.06.10 is a point release with fixes for vulnerabilities reported by multiple parties. The maintainers "strongly recommend upgrading" and "strongly encourage everyone to upgrade to 26.06.10 as soon as practical." The fixes are not under embargo. The maintainers are withholding the tests for the fixes to give node operators time to update.

Affected

• Core Lightning before 26.06.10
• Fixed in 26.06.10

Impact

The release notes list security fixes in dual funding and splicing, including signature checks on the peer's tx_signatures, along with fixes in onchaind HTLC resolution, gossip resource limits, connectd, runes and commando, plugin hooks and hsmd, "plus a number of remote-crash and hardening fixes." The Defiant reports that the fixes address channel-balance risks and remote crashes. The release notes do not list CVE identifiers and do not state whether these flaws have been exploited in the wild. Dual funding (--experimental-dual-fund) is still experimental.

Recommended actions

• Upgrade to Core Lightning 26.06.10. Verify signatures and checksums against the published signed manifest.
• Review the runes issued on your node. Bind runes to specific nodes and rotate any you cannot account for.

Source & attribution

This 0xCERT advisory summarises the Core Lightning 26.06.10 release notes by the Core Lightning maintainers (ElementsProject), which credit Vincenzo Palazzo, labrat-guy, Erick C, Paul Lamb, Kyle W. Santiago, The Bitcoin Red Team, 0xaudron, whkim0, Ahmadsm2005, Ben Carman, Michael1011, Nishant Bansal, Nuhiat Arefin, Matt Morehouse, Niklas Gögge, 3cola, Project Loupe, haoxucu, moinaiagent and others: https://github.com/ElementsProject/lightning/releases/tag/v26.06.10. Details may change; refer to the original source for the authoritative record.