{"action":"Upgrade github.com/lightningnetwork/lnd to 0.17.0-beta or later.","affected":[{"fixed":"0.17.0-beta","introduced":"0"}],"component":"github.com/lightningnetwork/lnd","cve_ids":["CVE-2024-38359"],"ecosystem":"Go","epss":0.00572,"exploited":false,"fixed_versions":["0.17.0-beta"],"ghsa_id":"GHSA-9gxx-58q6-42p7","id":"tcs_01M5KF5M0FV983E5X4TP01CH2S","modified_at":"2026-09-10T03:50:15.086090051Z","published_at":"2024-06-20T19:18:25Z","references":["https://osv.dev/vulnerability/GHSA-9gxx-58q6-42p7","https://github.com/lightningnetwork/lnd/security/advisories/GHSA-9gxx-58q6-42p7","https://nvd.nist.gov/vuln/detail/CVE-2024-38359","https://delvingbitcoin.org/t/dos-disclosure-lnd-onion-bomb/979","https://github.com/lightningnetwork/lnd","https://github.com/lightningnetwork/lnd/releases/tag/v0.17.0-beta","https://lightning.network","https://morehouse.github.io/lightning/lnd-onion-bomb"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-9gxx-58q6-42p7","url":"https://osv.dev/vulnerability/GHSA-9gxx-58q6-42p7"}],"summary":"Lightning Network Daemon (LND)'s onion processing logic leads to a denial of service"}