—
GO-2024-2943
Lightning Network Daemon (LND)'s onion processing logic leads to a denial of service in github.com/lightningnetwork/lnd
Quick fix
GO-2024-2943 — github.com/lightningnetwork/lnd: upgrade to the fixed version with the command below.
go get github.com/lightningnetwork/lnd@v0.17.0-betaDetails
Lightning Network Daemon (LND)'s onion processing logic leads to a denial of service in github.com/lightningnetwork/lnd
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/lightningnetwork/lnd
Introduced in:
0Fixed in: 0.17.0-betaFix
go get github.com/lightningnetwork/lnd@v0.17.0-betaReferences
- https://github.com/lightningnetwork/lnd/security/advisories/GHSA-9gxx-58q6-42p7[ADVISORY]
- https://nvd.nist.gov/vuln/detail/CVE-2024-38359[ADVISORY]
- https://delvingbitcoin.org/t/dos-disclosure-lnd-onion-bomb/979[WEB]
- https://github.com/lightningnetwork/lnd/releases/tag/v0.17.0-beta[WEB]
- https://lightning.network[WEB]
- https://morehouse.github.io/lightning/lnd-onion-bomb[WEB]