Filtered by vendor Lightning Network Daemon Project
Subscribe
Filtered by product Lightning Network Daemon
Subscribe
Search
Total
3 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-41593 | 1 Lightning Network Daemon Project | 1 Lightning Network Daemon | 2022-07-12 | 7.5 HIGH | 8.6 HIGH |
| Lightning Labs lnd before 0.13.3-beta allows loss of funds because of dust HTLC exposure. | |||||
| CVE-2020-26896 | 1 Lightning Network Daemon Project | 1 Lightning Network Daemon | 2020-11-05 | 5.8 MEDIUM | 8.2 HIGH |
| Prior to 0.11.0-beta, LND (Lightning Network Daemon) had a vulnerability in its invoice database. While claiming on-chain a received HTLC output, it didn't verify that the corresponding outgoing off-chain HTLC was already settled before releasing the preimage. In the case of a hash-and-amount collision with an invoice, the preimage for an expected payment was instead released. A malicious peer could have deliberately intercepted an HTLC intended for the victim node, probed the preimage through a colluding relayed HTLC, and stolen the intercepted HTLC. The impact is a loss of funds in certain situations, and a weakening of the victim's receiver privacy. | |||||
| CVE-2020-26895 | 1 Lightning Network Daemon Project | 1 Lightning Network Daemon | 2020-10-30 | 5.0 MEDIUM | 5.3 MEDIUM |
| Prior to 0.10.0-beta, LND (Lightning Network Daemon) would have accepted a counterparty high-S signature and broadcast tx-relay invalid local commitment/HTLC transactions. This can be exploited by any peer with an open channel regardless of the victim situation (e.g., routing node, payment-receiver, or payment-sender). The impact is a loss of funds in certain situations. | |||||