Go/github.com/lightningnetwork/lnd CVE-2024-38359: medium 6.5, EPSS 0.57%
Lightning Network Daemon (LND)'s onion processing logic leads to a denial of service
Action: Upgrade github.com/lightningnetwork/lnd to 0.17.0-beta or later.
go get github.com/lightningnetwork/lnd@v0.17.0-betaAffected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.17.0-beta | - |
Fixed versions
| 0.17.0-beta |
Sources
- osv: GHSA-9gxx-58q6-42p7
- https://github.com/lightningnetwork/lnd/security/advisories/GHSA-9gxx-58q6-42p7
- https://nvd.nist.gov/vuln/detail/CVE-2024-38359
- https://delvingbitcoin.org/t/dos-disclosure-lnd-onion-bomb/979
- https://github.com/lightningnetwork/lnd
- https://github.com/lightningnetwork/lnd/releases/tag/v0.17.0-beta
- https://lightning.network
- https://morehouse.github.io/lightning/lnd-onion-bomb
CVE-2024-38359 · published · modified · JSON