What the developer wrote
Authored by Madeline
Describe the change
What changed, and why it matters
This commit only edits the project's CHANGELOG.md file. It adds a one-line note saying the xpay plugin no longer crashes when handling circular route hints in bolt11 invoices, and adds a link to pull request #9174. The actual code fix is not present in this commit, so we can only judge the issue from the changelog description: a crash bug in a payment plugin triggered by unusual invoice route hints.
Review the actual code change in pull request #9174 to determine whether the crash is exploitable beyond a self-triggered denial of service, and whether it warrants a security advisory or CVE. Treat this commit as a documentation update only.
Security signals we found
Changelog entry describes a plugin crash (denial-of-service-like symptom)
Trigger involves circular bolt11 routehints in the xpay plugin
No source code patch is present in the supplied commit
Evidence from the diff
The diff is a documentation-only update to CHANGELOG.md. It records that pull request #9174 fixed a crash in the xpay plugin when bolt11 invoices contain circular routehints. No source code changes are included, so technical details of the vulnerability (e.g., null pointer, infinite loop, memory corruption) are unavailable. The referenced PR is not supplied as a verified reference.
Changed components
xpay pluginbolt11 invoice routehint handlingInspect captured patch +2 / −1
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d4af7ed1..ff29d61c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -69,7 +69,7 @@ Note: You should always set `allow-deprecated-apis=false` to test for changes.
- Protocol: use BOLT4's paranoid advice about doing constant-time error decryption. ([#9044])
- Fix for `splicein`, `spliceout`, and `dev-splice` commands where channel balances included partial sats. ([#9097])
- build: fix build errors with GCC 15 (Arch Linux). ([#9075])
-
+ - Plugins: xpay no longer crashes on circular bolt11 routehints. ([#9174])
### EXPERIMENTAL
@@ -89,6 +89,7 @@ Note: You should always set `allow-deprecated-apis=false` to test for changes.
[#9078]: https://github.com/ElementsProject/lightning/pull/9078
[#8981]: https://github.com/ElementsProject/lightning/pull/8981
[#8751]: https://github.com/ElementsProject/lightning/pull/8751
+[#9174]: https://github.com/ElementsProject/lightning/pull/9174
[#8807]: https://github.com/ElementsProject/lightning/pull/8807
[#9037]: https://github.com/ElementsProject/lightning/pull/9037
[#9119]: https://github.com/ElementsProject/lightning/pull/9119
Why this scored 23/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.