CVE-2024-38359

The Lightning Network Daemon (lnd) - is a complete implementation of a Lightning Network node. A parsing vulnerability in lnd's onion processing logic and lead to a DoS vector due to excessive memory allocation. The issue was patched in lnd v0.17.0. Users should update to a version > v0.17.0 to be protected. Users unable to upgrade may set the `--rejecthtlc` CLI flag and also disable forwarding on channels via the `UpdateChanPolicyCommand`, or disable listening on a public network interface via the `--nolisten` flag as a mitigation.

• CWE-20

• https://delvingbitcoin.org/t/dos-disclosure-lnd-onion-bomb/979
• https://github.com/lightningnetwork/lnd/releases/tag/v0.17.0-beta
• https://github.com/lightningnetwork/lnd/security/advisories/GHSA-9gxx-58q6-42p7
• https://lightning.network
• https://morehouse.github.io/lightning/lnd-onion-bomb
• https://delvingbitcoin.org/t/dos-disclosure-lnd-onion-bomb/979
• https://github.com/lightningnetwork/lnd/releases/tag/v0.17.0-beta
• https://github.com/lightningnetwork/lnd/security/advisories/GHSA-9gxx-58q6-42p7
• https://lightning.network
• https://morehouse.github.io/lightning/lnd-onion-bomb

Published

Jun 20, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-38353CodiMD allows realtime collaborative markdown notes on all p…5.3
• CVE-2024-38354CodiMD allows realtime collaborative markdown notes on all p…6.1
• CVE-2024-38355Socket.IO is an open source, real-time, bidirectional, event…7.3
• CVE-2024-38356TinyMCE is an open source rich text editor. A cross-site scr…6.1
• CVE-2024-38357TinyMCE is an open source rich text editor. A cross-site scr…6.1
• CVE-2024-38358Wasmer is a web assembly (wasm) Runtime supporting WASIX, WA…2.9
• CVE-2024-38360Discourse is an open source platform for community discussio…4.9
• CVE-2024-38361Spicedb is an Open Source, Google Zanzibar-inspired permissi…5.3
• CVE-2024-38363Airbyte is a data integration platform for ELT pipelines. Ai…8.5
• CVE-2024-38364DSpace is an open source software is a turnkey repository ap…2.6
• CVE-2024-38365btcd is an alternative full node bitcoin implementation writ…8.1
• CVE-2024-38366trunk.cocoapods.org is the authentication server for the Coa…10