Read the docs
TI-2021-18324 Aliases CVE-2021-41593GHSA-gjfm-mwrf-wg3p

Lightning Labs lnd before 0.13.3-beta allows loss of funds because of dust HTLC exposure.

Priority MEDIUM 41CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
Low · High · Low
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-770.

Summary

Lightning Labs lnd before 0.13.3-beta allows loss of funds because of dust HTLC exposure.

Why it matters now

EPSS 0.01932 80th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 38

CPEVersionsRoleVendor
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:*:*:*:*:*:*:*:*before 0.11.0VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.11.0:-:*:*:*:*:*:*0.11.0VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.11.0:beta:*:*:*:*:*:*0.11.0 betaVulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.11.0:beta_rc1:*:*:*:*:*:*0.11.0 beta_rc1VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.11.0:beta_rc2:*:*:*:*:*:*0.11.0 beta_rc2VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.11.0:beta_rc3:*:*:*:*:*:*0.11.0 beta_rc3VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.11.0:beta_rc4:*:*:*:*:*:*0.11.0 beta_rc4VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.11.1:beta:*:*:*:*:*:*0.11.1 betaVulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.11.1:beta_rc1:*:*:*:*:*:*0.11.1 beta_rc1VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.11.1:beta_rc2:*:*:*:*:*:*0.11.1 beta_rc2VulnerableLightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:*:*:*:*:*:*:*:* Versions before 0.11.0 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.11.0:-:*:*:*:*:*:* Versions 0.11.0 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.11.0:beta:*:*:*:*:*:* Versions 0.11.0 beta Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.11.0:beta_rc1:*:*:*:*:*:* Versions 0.11.0 beta_rc1 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.11.0:beta_rc2:*:*:*:*:*:* Versions 0.11.0 beta_rc2 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.11.0:beta_rc3:*:*:*:*:*:* Versions 0.11.0 beta_rc3 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.11.0:beta_rc4:*:*:*:*:*:* Versions 0.11.0 beta_rc4 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.11.1:beta:*:*:*:*:*:* Versions 0.11.1 beta Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.11.1:beta_rc1:*:*:*:*:*:* Versions 0.11.1 beta_rc1 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.11.1:beta_rc2:*:*:*:*:*:* Versions 0.11.1 beta_rc2 Vulnerable ·Lightning Network Daemon Project
Show 28 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.11.1:beta_rc3:*:*:*:*:*:*0.11.1 beta_rc3VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.11.1:beta_rc4:*:*:*:*:*:*0.11.1 beta_rc4VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.11.1:beta_rc5:*:*:*:*:*:*0.11.1 beta_rc5VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.12.0:beta:*:*:*:*:*:*0.12.0 betaVulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.12.0:beta_rc1:*:*:*:*:*:*0.12.0 beta_rc1VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.12.0:beta_rc2:*:*:*:*:*:*0.12.0 beta_rc2VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.12.0:beta_rc3:*:*:*:*:*:*0.12.0 beta_rc3VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.12.0:beta_rc4:*:*:*:*:*:*0.12.0 beta_rc4VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.12.0:beta_rc5:*:*:*:*:*:*0.12.0 beta_rc5VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.12.0:beta_rc6:*:*:*:*:*:*0.12.0 beta_rc6VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.12.1:beta:*:*:*:*:*:*0.12.1 betaVulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.12.1:beta_rc1:*:*:*:*:*:*0.12.1 beta_rc1VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.12.1:beta_rc2:*:*:*:*:*:*0.12.1 beta_rc2VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.12.1:beta_rc3:*:*:*:*:*:*0.12.1 beta_rc3VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.12.1:beta_rc4:*:*:*:*:*:*0.12.1 beta_rc4VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.12.1:beta_rc5:*:*:*:*:*:*0.12.1 beta_rc5VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.12.1:beta_rc6:*:*:*:*:*:*0.12.1 beta_rc6VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.13.0:beta:*:*:*:*:*:*0.13.0 betaVulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.13.0:beta_rc1:*:*:*:*:*:*0.13.0 beta_rc1VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.13.0:beta_rc2:*:*:*:*:*:*0.13.0 beta_rc2VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.13.0:beta_rc3:*:*:*:*:*:*0.13.0 beta_rc3VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.13.0:beta_rc4:*:*:*:*:*:*0.13.0 beta_rc4VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.13.0:beta_rc5:*:*:*:*:*:*0.13.0 beta_rc5VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.13.1:beta:*:*:*:*:*:*0.13.1 betaVulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.13.1:beta_rc1:*:*:*:*:*:*0.13.1 beta_rc1VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.13.1:beta_rc2:*:*:*:*:*:*0.13.1 beta_rc2VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.13.2:beta:*:*:*:*:*:*0.13.2 betaVulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.13.3:beta_rc2:*:*:*:*:*:*0.13.3 beta_rc2VulnerableLightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.11.1:beta_rc3:*:*:*:*:*:* Versions 0.11.1 beta_rc3 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.11.1:beta_rc4:*:*:*:*:*:* Versions 0.11.1 beta_rc4 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.11.1:beta_rc5:*:*:*:*:*:* Versions 0.11.1 beta_rc5 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.12.0:beta:*:*:*:*:*:* Versions 0.12.0 beta Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.12.0:beta_rc1:*:*:*:*:*:* Versions 0.12.0 beta_rc1 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.12.0:beta_rc2:*:*:*:*:*:* Versions 0.12.0 beta_rc2 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.12.0:beta_rc3:*:*:*:*:*:* Versions 0.12.0 beta_rc3 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.12.0:beta_rc4:*:*:*:*:*:* Versions 0.12.0 beta_rc4 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.12.0:beta_rc5:*:*:*:*:*:* Versions 0.12.0 beta_rc5 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.12.0:beta_rc6:*:*:*:*:*:* Versions 0.12.0 beta_rc6 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.12.1:beta:*:*:*:*:*:* Versions 0.12.1 beta Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.12.1:beta_rc1:*:*:*:*:*:* Versions 0.12.1 beta_rc1 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.12.1:beta_rc2:*:*:*:*:*:* Versions 0.12.1 beta_rc2 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.12.1:beta_rc3:*:*:*:*:*:* Versions 0.12.1 beta_rc3 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.12.1:beta_rc4:*:*:*:*:*:* Versions 0.12.1 beta_rc4 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.12.1:beta_rc5:*:*:*:*:*:* Versions 0.12.1 beta_rc5 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.12.1:beta_rc6:*:*:*:*:*:* Versions 0.12.1 beta_rc6 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.13.0:beta:*:*:*:*:*:* Versions 0.13.0 beta Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.13.0:beta_rc1:*:*:*:*:*:* Versions 0.13.0 beta_rc1 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.13.0:beta_rc2:*:*:*:*:*:* Versions 0.13.0 beta_rc2 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.13.0:beta_rc3:*:*:*:*:*:* Versions 0.13.0 beta_rc3 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.13.0:beta_rc4:*:*:*:*:*:* Versions 0.13.0 beta_rc4 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.13.0:beta_rc5:*:*:*:*:*:* Versions 0.13.0 beta_rc5 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.13.1:beta:*:*:*:*:*:* Versions 0.13.1 beta Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.13.1:beta_rc1:*:*:*:*:*:* Versions 0.13.1 beta_rc1 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.13.1:beta_rc2:*:*:*:*:*:* Versions 0.13.1 beta_rc2 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.13.2:beta:*:*:*:*:*:* Versions 0.13.2 beta Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.13.3:beta_rc2:*:*:*:*:*:* Versions 0.13.3 beta_rc2 Vulnerable ·Lightning Network Daemon Project

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-41593
  2. 2026-10-03 Alias added: GHSA-gjfm-mwrf-wg3p

References

Exploit 1

Advisory 5

  • TI-2022-18763 Witness Block Parsing DoS Vulnerability in lnd CVSS 3.1HIGH 8.2
  • TI-2020-16323 Prior to 0.11.0-beta, LND (Lightning Network Daemon) had a vulnerability in its invoice… CVSS 3.1HIGH 8.2
  • TI-2020-16322 Prior to 0.10.0-beta, LND (Lightning Network Daemon) would have accepted a counterparty… CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences