docs: add release note for DNS fallback SRV lookup panic fix
What the developer wrote
Authored by Erick Cestari
docs: add release note for DNS fallback SRV lookup panic fix
What changed, and why it matters
This commit only adds a release note describing a previously fixed bug in LND's DNS fallback code. The actual code fix is not shown in this commit. The bug could crash the LND daemon (a panic) if a DNS response contained unexpected record types during a special service-location lookup, or if a host lookup returned no results. Because this is just documentation, the immediate code risk is low, but the described underlying issue was a real crash bug.
Review pull request #10914 to confirm the actual code fix is present and complete. Ensure DNS fallback SRV lookup safely handles non-SRV records and empty LookupHost results. Consider whether malicious or misconfigured DNS responses could trigger the panic path.
Security signals we found
Denial of Service via daemon panic
Unsafe type assertion in DNS SRV lookup
Out-of-bounds index access on empty lookup result
Release note references security-relevant crash fix
Evidence from the diff
The commit is a documentation-only change to docs/release-notes/release-notes-0.22.0.md. It describes a fix for a panic in DNS fallback SRV lookup where the code unconditionally type-asserted DNS Answer records to *dns.SRV, causing a panic on non-SRV records. It also mentions an out-of-bounds index when LookupHost returned an empty result for the shim. The actual code fix is referenced via pull request #10914 but not present in this diff.
Changed components
LND DNS fallback SRV lookupdocs/release-notes/release-notes-0.22.0.mdInspect captured patch +6 / −0
diff --git a/docs/release-notes/release-notes-0.22.0.md b/docs/release-notes/release-notes-0.22.0.md
index 2f7f0ca..22eb449 100644
--- a/docs/release-notes/release-notes-0.22.0.md
+++ b/docs/release-notes/release-notes-0.22.0.md
@@ -42,6 +42,12 @@
regardless of peer connectivity. Uptime is now seeded from the peer's
actual connection state.
+* [Fixed a panic](https://github.com/lightningnetwork/lnd/pull/10914) in the
+ DNS fallback SRV lookup, which unconditionally type-asserted each DNS Answer
+ record to `*dns.SRV` and crashed the daemon when the response contained a
+ non-SRV record. Non-SRV records are now skipped, and an empty `LookupHost`
+ result for the shim no longer triggers an out-of-bounds index.
+
# New Features
## Functional Enhancements
Why this scored 58/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.