LND query_short_chan_ids Gossip Queue Out-of-Memory

Impact

Any peer, with no prior channel relationship, could exhaust a victim lnd node’s memory by sending a flood of query_short_chan_ids gossip messages. Two compounding buffers amplify the attack: the gossiper’s per-peer message stream holds up to 1,000 queued messages, and each GossipSyncer maintains an additional 100-message buffer. Each deserialized query_short_chan_ids message can be up to 128 KB (larger when zlib-encoded). A single peer can therefore force the victim to allocate approximately 140 MB of heap; repeated across multiple peers the node quickly runs out of memory and the process is OOM-killed.

There is no fund-loss path. The node restarts cleanly, but the attack can be repeated.

Severity

Scored against the Lightning Labs severity taxonomy (4-dimension rubric):

Dimension	Score	Reasoning
Impact	Low	OOM crash. The node restarts cleanly; no fund-loss path and no sustained liveness invalidation.
Attack Vector	High	Network. Any peer can send gossip messages with no prior channel relationship.
Exploitability	High	Flooding the buffers requires only repeated message sends; the stacked per-peer and per-syncer buffers make this reliably achievable.
Virality	Low	Per-victim. Each target requires a direct peer connection from the attacker; the attack does not propagate automatically.

Result: T3. Rule 3 (Impact = Low, base T3); no promotion because Virality is not High.

Patches

The issue was fixed in lnd v0.19.0-beta. The connection limit introduced to address the P2P connection-flooding issue also caps the per-peer memory exposure from this attack. Users should update to v0.19.0-beta or later to be protected.

Disclosure timeline

• Reported to Lightning Labs by Matt Morehouse.
• Fix merged and released in lnd v0.19.0-beta.
• Public disclosure: 2026-08-11.

Credit

Reported by Matt Morehouse.