LND gossip_timestamp_filter Goroutine Exhaustion DoS

Impact

Any peer, with no prior channel relationship, could crash a victim lnd node by repeatedly sending gossip_timestamp_filter messages. When lnd receives a gossip_timestamp_filter, it creates in-memory copies of all channel announcements, channel updates, and node announcements whose timestamps fall within the requested range — potentially more than 200,000 messages for a node with a complete view of the network graph — and spawns a goroutine to deliver them one-by-one to the requesting peer. Because lnd continued processing incoming messages from the same peer while those goroutines were active, an attacker could send additional gossip_timestamp_filter messages before the first batch was delivered, spawning more goroutines and creating additional in-memory copies of the full announcement set. Repeating this rapidly exhausted available memory and crashed the node.

There is no fund-loss path. The node restarts cleanly, but the attack can be repeated.

Severity

Scored against the Lightning Labs severity taxonomy (4-dimension rubric):

Dimension	Score	Reasoning
Impact	Low	OOM crash. The node restarts cleanly; no fund-loss path and no sustained liveness invalidation.
Attack Vector	High	Network. Any peer can send gossip_timestamp_filter messages with no prior channel relationship.
Exploitability	High	Trivially executable; repeated filter messages rapidly exhaust memory on any victim with a non-trivial routing graph.
Virality	Low	Per-victim. Each target requires a direct peer connection from the attacker; the attack does not propagate through the network.

Result: T3. Rule 3 (Impact = Low, base T3); no promotion because Virality is not High. A reachable non-viral crash-DoS is T3 regardless of how trivially it triggers.

Patches

The issue was fixed in lnd v0.18.3-beta by lnd #9009 — specifically commit 013452c, which replaces the per-syncer gossip-filter semaphore with a single global one shared across all syncers, bounding total concurrent backlog-send goroutines regardless of the number of connected peers. (The PR’s title refers only to its channel-announcement banning changes; the semaphore refactor rides alongside in the same commit.) Users should update to v0.18.3-beta or later to be protected.

Disclosure timeline

• Reported to Lightning Labs by Matt Morehouse.
• Uptake of the fixed release monitored before public disclosure.
• Matt Morehouse published an independent disclosure: Disclosure: LND gossip_timestamp_filter DoS.
• Public disclosure: 2026-08-11.

Credit

Reported by Matt Morehouse.

References

• Reporter’s disclosure: Disclosure: LND gossip_timestamp_filter DoS
• Fix: commit 013452c in lnd #9009