{"action":"Upgrade github.com/lightningnetwork/lnd to 0.17.0-beta or later.","affected":[{"fixed":"0.17.0-beta","introduced":"0"}],"component":"github.com/lightningnetwork/lnd","cve_ids":["CVE-2024-38359"],"ecosystem":"Go","epss":0.00572,"exploited":false,"fixed_versions":["0.17.0-beta"],"ghsa_id":"GHSA-9gxx-58q6-42p7","id":"tcs_01M5KG40PHNVN5BN3F8JSA5WPZ","modified_at":"2026-03-03T04:55:31.024897Z","published_at":"2024-07-01T19:59:12Z","references":["https://osv.dev/vulnerability/GO-2024-2943","https://github.com/lightningnetwork/lnd/security/advisories/GHSA-9gxx-58q6-42p7","https://nvd.nist.gov/vuln/detail/CVE-2024-38359","https://delvingbitcoin.org/t/dos-disclosure-lnd-onion-bomb/979","https://github.com/lightningnetwork/lnd/releases/tag/v0.17.0-beta","https://lightning.network","https://morehouse.github.io/lightning/lnd-onion-bomb"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2024-2943","url":"https://osv.dev/vulnerability/GO-2024-2943"}],"summary":"Lightning Network Daemon (LND)'s onion processing logic leads to a denial of service in github.com/lightningnetwork/lnd"}