ACINQ has released a second security update for its Eclair Bitcoin Lightning software in five days. The patches address flaws that malicious peers could exploit, and operators who installed the earlier release must upgrade again.
ACINQ released Eclair version 0.14.5 on Oct. 20, warning that hostile nodes could exploit some of the newly fixed vulnerabilities. The software powers Bitcoin Lightning nodes that maintain payment channels and route transactions across the network.
According to The Defiant, ACINQ said on X: "Node operators: upgrading is strongly advised."
What the new patches fix
The Defiant reports that one fix corrects a route-search retry for trampoline payments. The retry could let Eclair's outgoing conditional payments expire after the incoming payments funding them, exposing the forwarding node to a loss.
A second patch concerns splicing in Taproot channels. A peer could lie about an input's previous transaction output, inducing Eclair to sign a splice transaction that could never confirm. Eclair now checks the supplied output against data from its Bitcoin node.
A third patch fixes malformed payment-routing packets whose encoded length could bypass an earlier bounds check. Eclair now rejects those invalid lengths, according to The Defiant.
Upgrade without closing channels
Operators can install the update without closing existing payment channels, according to the release instructions. They must stop Eclair, install the new version and restart it.
The update follows an Oct. 15 security release, version 0.14.4. That version blocked API requests carrying an Origin header, which closed a route for a malicious website to send authenticated commands to a node through a web form. Browser-based management tools now need an intermediary backend to communicate with Eclair's API.
However, the fixes in 0.14.5 came after 0.14.4, so operators who installed the Oct. 15 release must upgrade again.
ACINQ has not detailed the newly patched exploit mechanisms or specified which older versions are affected. The announcement reported no confirmed attacks or financial losses.
Sources: CryptoSlate, The Defiant
Trading involves risk.
Risk Disclaimer
