What’s Vulnerable › Vulnerabilities

CVE-2021-41591

• Severity: critical (CVSS 9.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-10-04 · updated 2026-06-17
• Weakness: CWE-770

Description

ACINQ Eclair before 0.6.3 allows loss of funds because of dust HTLC exposure.

Affected products

• Acinq Eclair: before 0.6.3 — fixed in 0.6.3

How to fix

Upgrade to a fixed version: Acinq Eclair 0.6.3. Check the vendor advisory for mitigations.

References

• https://bitcoinmagazine.com/technical/good-griefing-a-lingering-vulnerability-on-lightning-network-that-still-needs-fixing
• https://github.com/ACINQ/eclair/pull/1985
• https://lists.linuxfoundation.org/pipermail/lightning-dev/2020-May/002714.html
• https://lists.linuxfoundation.org/pipermail/lightning-dev/2021-October/003257.html
• https://bitcoinmagazine.com/technical/good-griefing-a-lingering-vulnerability-on-lightning-network-that-still-needs-fixing
• https://github.com/ACINQ/eclair/pull/1985
• https://lists.linuxfoundation.org/pipermail/lightning-dev/2020-May/002714.html
• https://lists.linuxfoundation.org/pipermail/lightning-dev/2021-October/003257.html

Get alerted when CVE-2021-41591 or the next vulnerability affects your stack