LND Gossip Stall via Malformed channel_announcement Flood

Impact

A peer could stall a victim node’s entire gossip pipeline by sending more than 1000 malformed channel_announcement messages. Each announcement was crafted so that node_id_1 equalled node_id_2 and other fields were invalid, causing two separate failures during validation: one when the validation barrier removed a job under a duplicate key, and one when the announcement itself was rejected. Only one error could be delivered, so the second blocked, and the gossip processing capacity filled with stuck jobs.

Once stalled, the victim could neither receive nor propagate gossip. Its channels effectively became private to the rest of the network, its view of the graph stopped updating, and route discovery degraded. The node itself kept running.

There is no direct fund-loss path. Restarting the node clears the stall, but a graceful shutdown may hang on the stuck gossiper and the process may need to be killed; the attack can be repeated. The defect was introduced with the validation-barrier rework in 0.19.0-beta; earlier releases are not affected.

Severity

Scored against the Lightning Labs severity taxonomy:

Dimension	Score	Reasoning
Impact	Low	Degraded operation that a restart clears. No fund loss; payments on existing channels continue to work.
Attack Vector	High	Network. Any connected peer can send gossip.
Exploitability	High	Deterministic once the message count exceeds the barrier’s capacity.
Virality	Low	Per-victim. The malformed announcements are rejected and never relayed.

Result: T3. Rule 3 (Impact = Low, base T3); no promotion because Virality is not High.

Patches

Fixed in lnd v0.20.1-beta via lnd#10540 and its backport lnd#10554. The fix is also in v0.21.0-beta and later. Users should update to v0.20.1-beta or later on their release line.

Disclosure timeline

• Reported by Matt Morehouse and Nishant Bansal.
• Fix merged 2026-02-04; released in lnd v0.20.1-beta on 2026-02-12.
• Public disclosure: 2026-09-21.