According to CoinMeta, as reported by criptonoticias, developer Chandra Pratap discovered two denial-of-service (DoS) vulnerabilities in Core Lightning ( CLN ). Attackers can remotely and continuously send a large number of fake channel update messages without investing any funds on the chain or establishing a payment channel with the target, which can exhaust the node's memory and cause the system to crash. The two vulnerabilities affect the connectd and gossipd components respectively, and are considered to be of medium to high risk. The issues have been fixed in Core Lightning v26.04 and v26.06rc2. Officials recommend that node operators upgrade to the fixed versions.