All Posts
Vulnerability Disclosure: Another Memory Exhaustion DoS in Core Lightning
Summary Following up on my previous disclosure, I am releasing details on a third Denial-of-Service (DoS) vulnerability in Core Lightning (CLN). This vulnerability allowed a remote peer to trigger unbounded memory growth in the gossip daemon (gossipd), leading to an Out-of-Memory (OOM) system crash. This vulnerability has been patched in Core Lightning release v26.06rc2. All node operators are advised to upgrade accordingly. Background Core Lightning (CLN) uses a multi-daemon architecture, meant to isolate faults. The Lightning Network relies on a “gossip” protocol to propagate channel announcements, channel updates, node announcements, etc. In Core Lightning (CLN), the gossip daemon is responsible for managing this global view of the network.
July 19, 2026
Vulnerability Disclosure: Memory Exhaustion DoS in Core Lightning
Summary Following up on my previous disclosure, I am releasing details on a second Denial-of-Service (DoS) vulnerability in Core Lightning (CLN) discovered during my Summer of Bitcoin 2025 internship, which allowed a remote peer to trigger unbounded memory growth in the connect daemon (connectd), leading to an Out-of-Memory (OOM) system crash. This vulnerability has been patched in Core Lightning release v26.04. All node operators are advised to upgrade accordingly. Background Core Lightning (CLN) uses a multi-daemon architecture, meant to isolate faults. The Lightning Network relies on a “gossip” protocol to propagate channel announcements, channel updates, node announcements, etc. In Core Lightning (CLN), the gossip daemon is responsible for managing this global view of the network. It receives messages from connectd and processes them.
May 4, 2026
Vulnerability Disclosure: Assertion DoS in Core Lightning
Summary During my Summer of Bitcoin 2025 internship, I discovered a Denial-of-Service (DoS) vulnerability in Core Lightning (CLN) that allowed a remote peer to crash a node by sending a specifically crafted message. The issue was caused by an overly strict assertion in openingd’s logic. This vulnerability has been patched in Core Lightning release v26.04. All node operators are advised to upgrade accordingly. Background Core Lightning (CLN) uses a multi-daemon architecture. When a peer connects and attempts to open a channel, a specific sub-daemon (openingd) is spawned to handle the channel-opening process. This architecture is designed to isolate faults. If a crash occurs somewhere, it shouldn’t take down the whole node.
May 3, 2026
KittenCast: A local, lightweight document to audiobook compiler
I’m excited to share a project I’ve been working on: KittenCast, a lightweight CLI tool that converts EPUBs, PDFs, Word docs, and plain text files into audiobooks. The core requirement was strict: 100% local operation. No data leaks to cloud APIs, no unexpected usage costs: just your personal library and your CPU. Why I Built It There are plenty of cloud-based TTS APIs, but for long-form content like books, they become incredibly expensive. Furthermore, many readers prioritize privacy for their personal document libraries.
March 22, 2026