{"id":"CVE-2020-26895","details":"Prior to 0.10.0-beta, LND (Lightning Network Daemon) would have accepted a counterparty high-S signature and broadcast tx-relay invalid local commitment/HTLC transactions. This can be exploited by any peer with an open channel regardless of the victim situation (e.g., routing node, payment-receiver, or payment-sender). The impact is a loss of funds in certain situations.","modified":"2026-07-08T23:35:16.814197Z","published":"2020-10-21T02:15:12.660Z","references":[{"type":"ADVISORY","url":"https://gist.github.com/ariard/fb432a9d2cd3ba24fdc18ccc8c5c6eb4"},{"type":"ADVISORY","url":"https://lists.linuxfoundation.org/pipermail/lightning-dev/2020-October/002856.html"},{"type":"ADVISORY","url":"https://lists.linuxfoundation.org/pipermail/lightning-dev/2020-October/002858.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/lightningnetwork/lnd","events":[{"introduced":"4ccdad0d663f794181a368e5f006f34b28cf4df0"},{"last_affected":"1d548684e2b2bbbbf342ac3dd7076371550301ff"}],"database_specific":{"cpe":["cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.1:alpha:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.1.1:alpha:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.2:alpha:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.2.1:alpha:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.3:alpha:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.4:beta:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.4.1:beta:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.4.2:beta:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.5:beta:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.5:beta_rc1:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.5:beta_rc2:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.5.1:beta:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.5.1:beta_rc1:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.5.1:beta_rc2:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.5.1:beta_rc3:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.5.1:beta_rc4:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.5.2:beta:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.6:beta:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.6:beta_rc1:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.6:beta_rc2:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.6:beta_rc3:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.6:beta_rc4:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.6.1:beta:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.6.1:beta_rc1:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.6.1:beta_rc2:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.7.0:beta:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.7.0:beta_rc1:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.7.0:beta_rc2:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.7.0:beta_rc3:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.7.1:beta:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.7.1:beta_rc2:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.7.1:beta_rc1:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.8.0:beta:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.8.0:beta_rc1:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.8.0:beta_rc2:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.8.0:beta_rc3:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.8.1:beta:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.8.2:beta:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.8.2:beta_rc1:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.8.2:beta_rc2:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.9.0:beta:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.9.0:beta_rc1:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.9.0:beta_rc2:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.9.0:beta_rc3:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.9.0:beta_rc4:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.9.1:beta:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.9.1:beta_rc1:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.9.2:beta:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.10.0:beta_rc1:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.10.0:beta_rc2:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.10.0:beta_rc3:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.10.0:beta_rc4:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.10.0:beta_rc5:*:*:*:*:*:*","cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.10.0:beta_rc6:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0.1-alpha"},{"last_affected":"0.1-alpha"},{"introduced":"0.1.1-alpha"},{"last_affected":"0.1.1-alpha"},{"introduced":"0.2-alpha"},{"last_affected":"0.2-alpha"},{"introduced":"0.2.1-alpha"},{"last_affected":"0.2.1-alpha"},{"introduced":"0.3-alpha"},{"last_affected":"0.3-alpha"},{"introduced":"0.4-beta"},{"last_affected":"0.4-beta"},{"introduced":"0.4.1-beta"},{"last_affected":"0.4.1-beta"},{"introduced":"0.4.2-beta"},{"last_affected":"0.4.2-beta"},{"introduced":"0.5-beta"},{"last_affected":"0.5-beta"},{"introduced":"0.5-beta_rc1"},{"last_affected":"0.5-beta_rc1"},{"introduced":"0.5-beta_rc2"},{"last_affected":"0.5-beta_rc2"},{"introduced":"0.5.1-beta"},{"last_affected":"0.5.1-beta"},{"introduced":"0.5.1-beta_rc1"},{"last_affected":"0.5.1-beta_rc1"},{"introduced":"0.5.1-beta_rc2"},{"last_affected":"0.5.1-beta_rc2"},{"introduced":"0.5.1-beta_rc3"},{"last_affected":"0.5.1-beta_rc3"},{"introduced":"0.5.1-beta_rc4"},{"last_affected":"0.5.1-beta_rc4"},{"introduced":"0.5.2-beta"},{"last_affected":"0.5.2-beta"},{"introduced":"0.6-beta"},{"last_affected":"0.6-beta"},{"introduced":"0.6-beta_rc1"},{"last_affected":"0.6-beta_rc1"},{"introduced":"0.6-beta_rc2"},{"last_affected":"0.6-beta_rc2"},{"introduced":"0.6-beta_rc3"},{"last_affected":"0.6-beta_rc3"},{"introduced":"0.6-beta_rc4"},{"last_affected":"0.6-beta_rc4"},{"introduced":"0.6.1-beta"},{"last_affected":"0.6.1-beta"},{"introduced":"0.6.1-beta_rc1"},{"last_affected":"0.6.1-beta_rc1"},{"introduced":"0.6.1-beta_rc2"},{"last_affected":"0.6.1-beta_rc2"},{"introduced":"0.7.0-beta"},{"last_affected":"0.7.0-beta"},{"introduced":"0.7.0-beta_rc1"},{"last_affected":"0.7.0-beta_rc1"},{"introduced":"0.7.0-beta_rc2"},{"last_affected":"0.7.0-beta_rc2"},{"introduced":"0.7.0-beta_rc3"},{"last_affected":"0.7.0-beta_rc3"},{"introduced":"0.7.1-beta"},{"last_affected":"0.7.1-beta"},{"introduced":"0.7.1-beta_rc2"},{"last_affected":"0.7.1-beta_rc2"},{"introduced":"0.7.1-beta_rc1"},{"last_affected":"0.7.1-beta_rc1"},{"introduced":"0.8.0-beta"},{"last_affected":"0.8.0-beta"},{"introduced":"0.8.0-beta_rc1"},{"last_affected":"0.8.0-beta_rc1"},{"introduced":"0.8.0-beta_rc2"},{"last_affected":"0.8.0-beta_rc2"},{"introduced":"0.8.0-beta_rc3"},{"last_affected":"0.8.0-beta_rc3"},{"introduced":"0.8.1-beta"},{"last_affected":"0.8.1-beta"},{"introduced":"0.8.2-beta"},{"last_affected":"0.8.2-beta"},{"introduced":"0.8.2-beta_rc1"},{"last_affected":"0.8.2-beta_rc1"},{"introduced":"0.8.2-beta_rc2"},{"last_affected":"0.8.2-beta_rc2"},{"introduced":"0.9.0-beta"},{"last_affected":"0.9.0-beta"},{"introduced":"0.9.0-beta_rc1"},{"last_affected":"0.9.0-beta_rc1"},{"introduced":"0.9.0-beta_rc2"},{"last_affected":"0.9.0-beta_rc2"},{"introduced":"0.9.0-beta_rc3"},{"last_affected":"0.9.0-beta_rc3"},{"introduced":"0.9.0-beta_rc4"},{"last_affected":"0.9.0-beta_rc4"},{"introduced":"0.9.1-beta"},{"last_affected":"0.9.1-beta"},{"introduced":"0.9.1-beta_rc1"},{"last_affected":"0.9.1-beta_rc1"},{"introduced":"0.9.2-beta"},{"last_affected":"0.9.2-beta"},{"introduced":"0.10.0-beta_rc1"},{"last_affected":"0.10.0-beta_rc1"},{"introduced":"0.10.0-beta_rc2"},{"last_affected":"0.10.0-beta_rc2"},{"introduced":"0.10.0-beta_rc3"},{"last_affected":"0.10.0-beta_rc3"},{"introduced":"0.10.0-beta_rc4"},{"last_affected":"0.10.0-beta_rc4"},{"introduced":"0.10.0-beta_rc5"},{"last_affected":"0.10.0-beta_rc5"},{"introduced":"0.10.0-beta_rc6"},{"last_affected":"0.10.0-beta_rc6"}],"source":"CPE_STRING"}}],"versions":["0.1-alpha","0.1.1-alpha","0.10.0-beta_rc1","0.10.0-beta_rc2","0.10.0-beta_rc3","0.10.0-beta_rc4","0.10.0-beta_rc5","0.10.0-beta_rc6","0.2-alpha","0.2.1-alpha","0.3-alpha","0.4-beta","0.4.1-beta","0.4.2-beta","0.5-beta","0.5-beta_rc1","0.5-beta_rc2","0.5.1-beta","0.5.1-beta_rc1","0.5.1-beta_rc2","0.5.1-beta_rc3","0.5.1-beta_rc4","0.5.2-beta","0.6-beta","0.6-beta_rc1","0.6-beta_rc2","0.6-beta_rc3","0.6-beta_rc4","0.6.1-beta","0.6.1-beta_rc1","0.6.1-beta_rc2","0.7.0-beta","0.7.0-beta_rc1","0.7.0-beta_rc2","0.7.0-beta_rc3","0.7.1-beta","0.7.1-beta_rc1","0.8.0-beta","0.8.0-beta_rc1","0.8.0-beta_rc2","0.8.0-beta_rc3","0.8.1-beta","0.8.2-beta","0.8.2-beta_rc1","0.8.2-beta_rc2","0.9.0-beta","0.9.0-beta_rc1","0.9.0-beta_rc2","0.9.0-beta_rc3","0.9.0-beta_rc4","0.9.1-beta","0.9.1-beta_rc1","0.9.2-beta","v0.10.0-beta.rc5","v0.10.0-beta.rc6","v0.10.0-beta.rc4","v0.10.0-beta.rc3","cert/v1.0.2","v0.10.0-beta.rc2","v0.10.0-beta.rc1","queue/v1.0.3","cert/v1.0.1","v0.9.0-beta","v0.9.0-beta-rc4","v0.9.0-beta-rc3","v0.9.0-beta-rc2","v0.9.0-beta-rc1","queue/v1.0.2","v0.8.0-beta","v0.8.0-beta-rc3","v0.8.0-beta-rc2","v0.8.0-beta-rc1","v0.7.1-beta-rc2","v0.7.1-beta","v0.7.1-beta-rc1","v0.7.0-beta","v0.7.0-beta-rc2","v0.7.0-beta-rc3","v0.7.0-beta-rc1","v0.6.1-beta","v0.6.1-beta-rc2","v0.6.1-beta-rc1","v0.6.0-beta","v0.6-beta","v0.5.1-beta","v0.6-beta-rc4","v0.6-beta-rc3","v0.6-beta-rc2","v0.6-beta-rc1","upstream","queue/v1.0.1","v0.5.1-beta-rc4","v0.5.1-beta-rc3","v0.5.1-beta-rc2","v0.5.1-beta-rc1","v0.5-beta","v0.5-beta-rc2","v0.5-beta-rc1","v0.4.2-beta","v0.4.1-beta","v0.4-beta","v0.3-alpha","v0.2.1-alpha","v0.2-alpha","v0.1.1-alpha","v0.1-alpha"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-26895.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}]}