Witness Block Parsing DoS Vulnerability in lnd

Vulnerability

Lightning Network Daemon (lnd) nodes prior to version v0.15.4 are vulnerable to a block parsing bug that triggers when processing transactions with a very large number of witness inputs [1][2][4]. Once encountered, the node enters a degraded state where it can no longer properly parse blocks, leading to critical functionality loss.

Exploitation

An attacker can exploit this by broadcasting a transaction with an excessive number of witness inputs, which is parsed incorrectly by the vulnerable node [4]. No authentication is required beyond network connectivity; the bug affects the default block processing routine. In the degraded state, the node can still make payments and forward HTLCs, but it cannot open new channels and fails to detect on-chain transaction events [1][4].

Impact

This impairment can lead to loss of funds if a CSV expiry is reached during a channel breach attempt or a CLTV delta expires while HTLC funds remain locked, as the node will not react to on-chain events [1][4]. The node effectively becomes blind to certain on-chain activity, increasing risk of fund loss.

Mitigation

A patch is available in lnd version 0.15.4 [2]. Users unable to upgrade can use the lncli updatechanpolicy RPC to set a very high CLTV value or increase fee policies, which prevents other nodes from routing through them, thereby avoiding pending HTLCs that could be affected [1][4].