CVE-2021-41593

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

Lightning Labs lnd before 0.13.3-beta allows loss of funds because of dust HTLC exposure.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Weakness enumeration

CWE-770

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bitcoinmagazine.com/technical/good-griefing-a-lingering-vulnerability-on-lightning-network-that-still-needs-fixingPress/Media Coverage, Third Party Advisory
https://github.com/lightningnetwork/lnd/blob/master/docs/release-notes/release-notes-0.13.3.mdRelease Notes, Third Party Advisory
https://github.com/lightningnetwork/lnd/releases/tag/v0.13.3-betaThird Party Advisory
https://lists.linuxfoundation.org/pipermail/lightning-dev/2020-May/002714.htmlMailing List, Vendor Advisory
https://lists.linuxfoundation.org/pipermail/lightning-dev/2021-October/003257.htmlMailing List, Vendor Advisory
https://lists.linuxfoundation.org/pipermail/lightning-dev/2021-October/003264.htmlExploit, Mailing List, Vendor Advisory
https://bitcoinmagazine.com/technical/good-griefing-a-lingering-vulnerability-on-lightning-network-that-still-needs-fixingPress/Media Coverage, Third Party Advisory
https://github.com/lightningnetwork/lnd/blob/master/docs/release-notes/release-notes-0.13.3.mdRelease Notes, Third Party Advisory
https://github.com/lightningnetwork/lnd/releases/tag/v0.13.3-betaThird Party Advisory
https://lists.linuxfoundation.org/pipermail/lightning-dev/2020-May/002714.htmlMailing List, Vendor Advisory
https://lists.linuxfoundation.org/pipermail/lightning-dev/2021-October/003257.htmlMailing List, Vendor Advisory
https://lists.linuxfoundation.org/pipermail/lightning-dev/2021-October/003264.htmlExploit, Mailing List, Vendor Advisory

Timeline

Published: Oct 4, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-415946.5In RSA Archer 6.9.SP1 P3, if some application functions are precluded by the Administrator, this can be bypassed by intercepting the API req CVE-2021-415955.3SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal. An attacker can partially include arbitrary files CVE-2021-415965.3SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal. An attacker can partially include arbitrary files CVE-2021-415978.8SuiteCRM through 7.11.21 is vulnerable to CSRF, with resultant remote code execution, via the UpgradeWizard functionality, if a PHP file is CVE-2021-415988.8A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed more permissions to be granted during a GitHub CVE-2021-415998.8A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. CVE-2021-41605.9There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS 1.3 CVE-2021-416087.5A file disclosure vulnerability in the UploadedImageDisplay.aspx endpoint of SelectSurvey.NET before 5.052.000 allows a remote, unauthentica CVE-2021-416099.8SQL injection in the ID parameter of the UploadedImageDisplay.aspx endpoint of SelectSurvey.NET before 5.052.000 allows a remote, unauthenti CVE-2021-41617.5The affected products contain vulnerable firmware, which could allow an attacker to sniff the traffic and decrypt login credential details. CVE-2021-416117.5An issue was discovered in Squid 5.0.6 through 5.1.x before 5.2. When validating an origin server or peer certificate, Squid may incorrectly CVE-2021-416128.8An issue was discovered in the ALU unit of the OpenRISC mor1kx processor. The carry flag is not being updated correctly for the subtract ins