Core Lightning 26.06.9 Fixes Payment Delays and Security Flaws

Core Lightning released version 26.06.9 to fix security flaws, address a regression that delayed Bitcoin payment traffic on busy nodes and protect forwarded funds during channel shutdowns.

The release appeared on GitHub on Oct. 7, while its versioned changelog is dated Oct. 6. Maintainers recommend that operators, especially those running version 26.06.8, upgrade as soon as practical.

Version 26.06.8 counted routine gossip, ping and onion messages against a CPU budget reserved for gossip queries. On busy nodes, the accounting could restrict peer activity and delay traffic through payment channels. Version 26.06.9 reserves the budget for gossip queries, removing the reported source of the slowdown.

The update also fixes a channel-shutdown issue involving Hash Time-Locked Contracts, or HTLCs. These contracts help route payments through the Lightning Network and expire after a set deadline. If an HTLC reached its deadline while a channel was shutting down, version 26.06.9 now force-closes the channel. The change is intended to prevent forwarded funds from being lost if a payment is completed after the deadline.

The release adds permission safeguards for runes, which authorize calls to a Lightning node. Restrictions on a rune now apply when creating or listing blocked runes. A restricted rune cannot create an unrestricted rune or relist one that has been blocked. The same restrictions apply to the invokerune and destroyrune command aliases.

The listconfigs command now masks sensitive data, including recovery information and Bitcoin RPC passwords, for every caller. The setconfig command blocks a method of injecting configuration lines through persistent option values.

Security tests for the fixes are being temporarily withheld. The delay is intended to give operators more time to install the update and make exploit development harder. Operators who have run a development version cannot downgrade to a 26.06.x release because the newer version uses a later database schema.

The release follows a Sept. 27 flaw involving penalties for revoked channels, which was fixed in version 26.06.7. Version 26.06.9 fixes a later regression associated with that update and adds safeguards for payment processing and node administration.

The changelog continues to describe dual funding as experimental and advises operators against using zero-confirmation channels with untrusted peers. Core Lightning is software for operating Bitcoin Lightning nodes, which route payments through channels established between participants.