The Frontier

LND 0.21.6 and 0.20.7 disable multi-TCP listeners by default to mitigate a Linux kernel vulnerability that could allow remote code execution. The LND change does not patch the kernel, so affected systems still need a kernel update.

LND PR 11357 tightens BOLT11 invoice parsing by rejecting duplicate payment-secret fields and incorrectly sized fields, avoiding ambiguity between implementations. It also requires low-S ECDSA signatures when an invoice explicitly includes a receiver public key.

LND PR 11413 batches cleanup of resolved locally initiated HTLC results during startup, avoiding repeated database round trips that could make PostgreSQL cleanup take hours. The benchmark showed a 30-fold speedup even with a local database.

LND PR 11151 rejects incoming channels with excessive commitment fees and enforces both sides’ initial reserve requirements. The fee cap is the greater of ten times the three-block estimate or 100 sat/vbyte; reserves preserve a penalty balance if a peer cheats.