docs: add release note for DNS fallback SRV lookup panic fix 0.21.1
What the developer wrote
Authored by Erick Cestari
docs: add release note for DNS fallback SRV lookup panic fix 0.21.1
What changed, and why it matters
This commit is just a documentation update adding a release note for a previously fixed bug. The actual bug was a crash (panic) in LND's DNS fallback code: when looking up network routing information, the program assumed every answer from a DNS server would be a specific record type (SRV). If a DNS server returned a different kind of record, the program would crash. The fix also handled an empty lookup result safely. This release note describes that earlier code fix; the commit itself does not change any program code.
Treat this as confirmation that a DoS-class bug was fixed in PR #10914. Review the actual code fix in PR #10914 to confirm the panic paths are fully addressed, and ensure DNS responses are not blindly trusted in SRV lookup paths.
Security signals we found
Denial of Service (daemon panic/crash) via DNS response manipulation
Unsafe type assertion in DNS SRV lookup path
Out-of-bounds index access on empty LookupHost result
Release note confirms security-relevant crash fix
Evidence from the diff
The commit adds a release note entry for PR #10914, which fixed a panic in LND’s DNS fallback SRV lookup path. The original code unconditionally type-asserted each DNS Answer record to *dns.SRV, causing a runtime panic if the response contained non-SRV records. The fix skips non-SRV records and avoids an out-of-bounds index when LookupHost returns an empty result. This commit only modifies docs/release-notes/release-notes-0.21.1.md; it does not contain the actual code fix.
Changed components
LND DNS fallback SRV lookupdocs/release-notes/release-notes-0.21.1.mdInspect captured patch +6 / −0
diff --git a/docs/release-notes/release-notes-0.21.1.md b/docs/release-notes/release-notes-0.21.1.md
index 207f8f8..4741674 100644
--- a/docs/release-notes/release-notes-0.21.1.md
+++ b/docs/release-notes/release-notes-0.21.1.md
@@ -29,6 +29,12 @@
which could default new onion service creation to the retired v2
`NEW:RSA1024` key type that modern Tor rejects with `513 Invalid key type`.
+* [Fixed a panic](https://github.com/lightningnetwork/lnd/pull/10914) in the
+ DNS fallback SRV lookup, which unconditionally type-asserted each DNS Answer
+ record to `*dns.SRV` and crashed the daemon when the response contained a
+ non-SRV record. Non-SRV records are now skipped, and an empty `LookupHost`
+ result for the shim no longer triggers an out-of-bounds index.
+
# New Features
## Functional Enhancements
Why this scored 58/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.