btcd Out-of-Memory via Oversized reject Messages

Impact

After the alert message was removed and the cfcheckpt limit was reduced in v0.25.0, the reject message still declared a maximum payload equal to the overall message limit of 32 MB, so a single reject message could make the node allocate tens of megabytes before parsing.

The message is parsed before the version handshake completes, so an unauthenticated host could send it as its first packet. With enough connections a node exhausted memory and was OOM-killed. The reporter reproduced this against a 2 GB node using 125 simulated peers.

Bitcoin Core deprecated reject in v0.18.0 (2019) and removed it in v0.20.0 (2020); the message has no role on the modern network.

There is no fund-loss path. The node restarts cleanly.

Severity

Scored against the Lightning Labs severity taxonomy:

Dimension	Score	Reasoning
Impact	Low	OOM crash, operator-recoverable by restart.
Attack Vector	High	Network. Reachable before the handshake, so any host that can open a TCP connection to the listener.
Exploitability	High	Reliable against a default configuration with bandwidth and connections.
Virality	Low	Per-victim sustained connections; nothing propagates.

Result: T3. Rule 3 (Impact = Low, base T3); no promotion because Virality is not High.

Patches

Fixed in btcd v0.26.0 via btcd#2479, which first cut the maximum message payload to 4 MiB, and btcd#2504, which introduced a separate 4 MB limit on network messages (MaxProtocolMessageLength, matching Bitcoin Core’s MAX_PROTOCOL_MESSAGE_LENGTH) enforced on every read path, with btcd#2518 pointing the reject decoder at it. On the default v1 transport an oversized reject is rejected at the header before any payload is allocated; on the opt-in --v2transport the check runs after the transport layer has decrypted the packet. Users should update to v0.26.0 or later.

Disclosure timeline

• Reported by Erick Cestari as a follow-up to the earlier alert/cfcheckpt report.
• Fixes merged 2026-03-10 and 2026-04-08; released in btcd v0.26.0 on 2026-06-18.
• Public disclosure: 2026-09-21.