LND Gossip Query Denial of Service

Impact

A peer could render a victim lnd node unresponsive by sending a large volume of gossip query messages. Without per-peer connection limits or bytes-based rate limiting on gossip query processing, a sustained query stream from a single peer could exhaust node resources and cause a denial of service.

There is no fund-loss path. The node restarts cleanly, but the attack can be repeated.

Severity

Scored against the Lightning Labs severity taxonomy (4-dimension rubric):

Dimension	Score	Reasoning
Impact	Low	Transient denial of service. The node restarts cleanly; no fund-loss path and no sustained liveness invalidation.
Attack Vector	High	Network. Any peer can send gossip query messages with no prior channel relationship.
Exploitability	High	Sending gossip query messages requires no special capability; flooding is straightforward on a default configuration.
Virality	Low	Per-victim. The attacker must establish a direct connection to each target; the attack does not self-propagate.

Result: T3. Rule 3 (Impact = Low, base T3); no promotion because Virality is not High.

Patches

The issue was fixed in lnd v0.19.0-beta by the combination of two changes: the global inbound non-channel peer connection limit (also cited on the P2P connection flooding advisory), and lnd #9607 (“discovery: unify rate.Limiter across all gossip peers”), which replaces the previous message-count rate limit with a byte-rate limit on outbound gossip traffic and exposes it as two new configuration flags (--gossip.msg-rate-bytes and --gossip.msg-burst-bytes). Together these bound both how many peers can query in parallel and how much serialized gossip data any one peer can extract per second. Users should update to v0.19.0-beta or later to be protected.

Disclosure timeline

• Reported to Lightning Labs by Matt Morehouse on 2023-09-15.
• Fix merged and released in lnd v0.19.0-beta.
• Public disclosure: 2026-08-11.

Credit

Reported by Matt Morehouse.