-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/lightningnetwork/lnd | go | < 0.15.2-beta | 0.15.2-beta |
| github.com/btcsuite/btcd | go | < 0.23.2 | 0.23.2 |
Miggo AIRoot Cause AnalysisThe commit diff shows the witness size check was modified in wire/msgtx.go's BtcDecode method. The vulnerability stemmed from enforcing SegWit v0-era witness size limits (11KB) at the wire parsing layer, while the correct approach is to handle this at the transaction validation layer with higher limits (~4MB). The Go vulnerability database (GO-2022-1098) explicitly lists MsgTx.BtcDecode as an affected symbol, and the patch increases maxWitnessItemSize to 4MB in this function's context.