CVE-2024-38359: Lightning Network Daemon Project Lightning Network Daemon

Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days.

The Lightning Network Daemon (lnd) - is a complete implementation of a Lightning Network node. A parsing vulnerability in lnd's onion processing logic and lead to a DoS vector due to excessive memory allocation. The issue was patched in lnd v0.17.0. Users should update to a version > v0.17.0 to be protected. Users unable to upgrade may set the `--rejecthtlc` CLI flag and also disable forwarding on channels via the `UpdateChanPolicyCommand`, or disable listening on a public network interface via the `--nolisten` flag as a mitigation.

Affected products

• Lightning Network Daemon Project Lightning Network Daemon: before 0.17.0 (fixed in 0.17.0)
• Lightningnetwork Lnd: before 0.17.0 (fixed in 0.17.0)

Published 2024-06-20. Last modified 2026-06-17.