docs: add v0.20.4 release notes for ws proxy fixes
What the developer wrote
Authored by Gijs van Dam
docs: add v0.20.4 release notes for ws proxy fixes
Adds entries for the Sec-Websocket-Protocol panic under Bug Fixes and for
the incoming message size bound under Functional Updates.
What changed, and why it matters
This commit adds release notes for two fixes in LND's REST WebSocket proxy. One fix prevents a server crash (panic) triggered by a malformed WebSocket protocol header. The other fix limits how large incoming WebSocket messages can be, rejecting oversized frames early. Both are defensive hardening changes, but the commit itself only documents them; the actual code changes are in a different pull request.
Review PR #11122 directly to confirm the code fix is complete and correctly bounds incoming frames. Operators running LND with REST/WebSocket exposure should plan to upgrade to v0.20.4. No immediate action is required solely from this documentation commit.
Security signals we found
Denial-of-service vector: malformed Sec-Websocket-Protocol header caused a panic in the REST WebSocket proxy
Input validation improvement: WebSocket sub-protocol header now parsed as a comma-separated list
Resource exhaustion mitigation: incoming WebSocket message size now bounded by MaxWsMsgSize with early rejection
Evidence from the diff
The commit updates release notes for LND v0.20.4 to describe PR #11122. The bug fix addresses an index-out-of-range panic in the REST WebSocket proxy when forwarding a Sec-Websocket-Protocol header containing an allowed field name without the required ‘+’ delimiter. The functional update adds MaxWsMsgSize enforcement on incoming WebSocket messages, rejecting oversized frames at the header stage rather than reading them fully. The commit is documentation-only; no code is changed here.
Changed components
REST WebSocket proxySec-Websocket-Protocol header handlingIncoming WebSocket message framingInspect captured patch +15 / −0
### docs/release-notes/release-notes-0.20.4.md
@@ -65,6 +65,14 @@
* [Fixed an issue](https://github.com/lightningnetwork/lnd/pull/11140) where the
incoming side of a forwarded dust HTLC could remain stuck.
+* [Fixed a panic](https://github.com/lightningnetwork/lnd/pull/11122) in the
+ REST WebSocket proxy, where a `Sec-Websocket-Protocol` header carrying an
+ allowed field name without the `+` delimiter caused an index out of range
+ while the header was being forwarded to the backend. The header is now parsed
+ as the comma separated list of sub protocols it is, so a bare protocol name
+ can also no longer pick up the value of an unrelated sub protocol in the same
+ list.
+
# New Features
## Functional Enhancements
@@ -77,6 +85,12 @@
## Functional Updates
+* The REST WebSocket proxy now [bounds the size of incoming
+ messages](https://github.com/lightningnetwork/lnd/pull/11122) using
+ `MaxWsMsgSize`, the limit that was already applied to the responses it writes
+ back out. Oversized frames are rejected from their header rather than read in
+ full.
+
## RPC Updates
## lncli Updates
@@ -102,6 +116,7 @@
# Contributors (Alphabetical Order)
* Boris Nagaev
+* Gijs van Dam
* LNBiG
* Yong Yu
* ZiggieWhy this scored 60/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.