LND ChannelReestablish Message Queue Out-of-Memory

Impact

A peer with pending channels open against a victim lnd node could exhaust the node’s heap memory by spamming channel_reestablish messages. Each connection’s chanMsgStream holds up to 1,000 queued messages; pending channels do not drain that stream until the link becomes active. A single attacker connection could therefore accumulate approximately 20 MB of heap. Scaled across the maximum permitted number of pending channels, an attacker could force the victim to allocate approximately 20 GB of heap memory, OOM-killing the process.

There is no fund-loss path. The node restarts cleanly, but the attack can be resumed as long as the pending channel relationships remain.

Severity

Scored against the Lightning Labs severity taxonomy (4-dimension rubric):

Dimension	Score	Reasoning
Impact	Low	OOM crash. The node restarts cleanly; no fund-loss path and no sustained liveness invalidation.
Attack Vector	High	Network. Any peer can initiate the channel openings needed to reach the affected queue; no funded channel or prior trust relationship is required.
Exploitability	High	Saturating a single connection’s queue is trivial; scaling to the pending-channel limit is feasible for a motivated attacker.
Virality	Low	Per-victim. The attacker must have pending channels in place for each target; the attack does not propagate automatically.

Result: T3. Rule 3 (Impact = Low, base T3); no promotion because Virality is not High.

Patches

The issue was fixed in lnd v0.19.0-beta by capping the chanMsgStream queue size and reducing the global pending-channel limit from 1,000 to 50. Users should update to v0.19.0-beta or later to be protected.

Disclosure timeline

• Identified internally by the Lightning Labs security team.
• Fix merged and released in lnd v0.19.0-beta.
• Public disclosure: 2026-08-11.