Core Lightning, software for running Bitcoin Lightning payment nodes, released v26.06.9 on October 7 with security fixes and a repair for a regression that could delay channel traffic on busy nodes running the previous v26.06.8 version.
The update addresses multiple issues, including a message-budget regression that affected routine network operations. In v26.06.8, gossip, pings, and onion messages were counted toward a CPU budget intended for gossip queries. On busy nodes, this accounting throttled peers and delayed channel traffic. Version 26.06.9 reserves that budget exclusively for gossip queries, removing the documented cause of this throttling.
Payment Protection During Shutdown
The patch also fixes a critical issue involving payment contracts, known as HTLCs, that reach their deadline while a channel is shutting down. Previously, forwarded funds could be lost if a payment was fulfilled after its deadline during channel closure. Version 26.06.9 now force-closes the channel in such situations, protecting operators who forward payments when payment deadlines and channel shutdown overlap.
Additional Security Improvements
The release enforces limits on runes used to authorize calls, preventing restricted runes from creating unrestricted ones or relisting blacklisted runes. The listconfigs command now masks sensitive values, including recovery information and Bitcoin RPC passwords, for all callers. The setconfig command has been patched to close a path for injecting configuration lines through persistent option values.
Core Lightning maintainers have temporarily withheld security tests to give node operators additional time to upgrade. Users, including those running v26.06.8, are urged to upgrade to v26.06.9 as soon as practical.
