CVE-2024-38359 json
Lightning Network Daemon Onion Bomb
published 2024-06-20 2 y ago modified 2026-09-10 1 mo ago also EUVD-2024-2003 , GHSA-9gxx-58q6-42p7 , GO-2024-2943
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 47%
- public exploits
- 0
- none known
Summary
The Lightning Network Daemon (lnd) - is a complete implementation of a Lightning Network node. A parsing vulnerability in lnd's onion processing logic and lead to a DoS vector due to excessive memory allocation. The issue was patched in lnd v0.17.0. Users should update to a version > v0.17.0 to be protected. Users unable to upgrade may set the `--rejecthtlc` CLI flag and also disable forwarding on channels via the `UpdateChanPolicyCommand`, or disable listening on a public network interface via the `--nolisten` flag as a mitigation.
Patch / fix
- go github.com/lightningnetwork/lnd 0.17.0-beta
- lightning_network_daemon_project lightning_network_daemon 0.17.0
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.57% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/lightningnetwork/lnd | <0.17.0-beta |
0.17.0-beta |
Affected products
- lightningnetwork lnd
- lightning_network_daemon_project lightning_network_daemon
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
github.com
/lightningnetwork/lnd/security/advisories/GHSA-9gxx-58q6-42p7
web, advisory
-
delvingbitcoin.org
/t/dos-disclosure-lnd-onion-bomb/979
web
-
github.com
/lightningnetwork/lnd/releases/tag/v0.17.0-beta
web
-
lightning.network
web
-
morehouse.github.io
/lightning/lnd-onion-bomb
web
-
nvd.nist.gov
/vuln/detail/CVE-2024-38359
advisory
-
github.com
/lightningnetwork/lnd
package
Sources
- CVE List CVE-2024-38359
- GitHub Advisory GHSA-9gxx-58q6-42p7
- NVD CVE-2024-38359
- OSV GO-2024-2943
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.