AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 28 Bitcoin

Remove support for zlib encoding for channel queries (#3263)

Public commit record

What the developer wrote

Authored by Bastien Teinturier

81/100 · Strong
Remove support for zlib encoding for channel queries (#3263)

We removed support for sending compressed data when it was removed from
the spec (see https://github.com/ACINQ/eclair/pull/2244). We meant to
remove support for receiving compressed data as well as a follow-up, but
it slipped for a long time! There's no reason to keep supporting it now.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
The short version

What changed, and why it matters

This commit removes the ability of the Eclair Lightning node to receive zlib-compressed channel-query data from peers. The Lightning protocol spec dropped zlib compression for these messages some time ago, and this change catches up by rejecting or ignoring compressed encodings. It is a hardening/cleanup change rather than a fix for an active vulnerability, though keeping a deprecated decompression path could in theory expose a node to memory or CPU issues if a peer sent malicious compressed data.

Recommended action

Treat as a routine spec-compliance cleanup. Operators should upgrade to avoid interoperability edge cases with peers that might still send compressed channel queries, and to remove the zlib parsing surface. No urgent mitigation is indicated by the commit itself. If an organization wants extra assurance, it could audit the removed zlib path for any latent parser weakness, but the commit provides no evidence of one.

Security signals we found

01

removal of deprecated zlib decompression path in network message parsing

02

spec-compliance hardening for Lightning routing protocol (gossip queries)

03

potential reduction of attack surface against compressed-payload parsing (e.g., memory/CPU amplification, though no specific bug is cited)

04

no CVE, advisory, or vendor security framing in commit message

Risk score

Why this scored 28/100

Our methodology →
Potential impact 5/30
Exploitability 4/25
Stealth signal 3/15
Affected reach 6/15
Confidence 7/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.