Core Lightning nodes can keep crashing after an upgrade until a stored trigger is removed

A disclosed flaw in Core Lightning, software for Bitcoin’s Lightning payment network, can leave a node crashing on restart even after an upgrade because the malicious announcement that triggered it remains on disk.Researcher Nishant Bansal’s October 24 disclosure identifies versions v25.02 through v26.04 as affected. Once the announcement is saved, restarting reloads the same trigger. Bansal says the operator must manually remove the offending record to restore the node.Bitcoin Optech highlighted the issue on October 30, but the preventive patch is months old. Core Lightning merged PR #9082 on April 24 and shipped the fix in v26.04.1 on April 25. The October disclosure explains a flaw whose preventive fix had been available since April.Why the patch does not clear a stored triggerChannel announcements tell nodes about connections in the Lightning routing graph. In this case, an announcement named the same previously unknown node as both endpoints. Vulnerable software accepted it and wrote it to its on-disk gossip_store before loading it into the routing graph.The graph then tried to insert that node twice. A safeguard against duplicates aborted gossipd, the component handling these...