docs: add v0.21.3 release notes for ws proxy fixes
What the developer wrote
Authored by Gijs van Dam
docs: add v0.21.3 release notes for ws proxy fixes
Adds entries for the Sec-Websocket-Protocol panic under Bug Fixes and for
the incoming message size bound under Functional Updates.
What changed, and why it matters
This commit adds release notes for two fixes in LND's REST WebSocket proxy: one that could crash the proxy with a malformed header, and another that limits how large incoming WebSocket messages can be. The actual code changes happened in a different pull request; this commit only documents them.
Review PR #11122 directly to confirm the code fix is complete and that the panic path and oversized-frame path are both covered. Apply the v0.21.3 update if the REST API/WebSocket proxy is exposed.
Security signals we found
Denial-of-service vector: malformed Sec-Websocket-Protocol header could panic the REST WebSocket proxy
Input validation improvement: header now parsed as comma-separated sub-protocol list
Resource-exhaustion mitigation: incoming WebSocket message size now bounded by MaxWsMsgSize
Evidence from the diff
The commit updates release notes for LND v0.21.3 to describe PR #11122. That PR fixed a panic in the REST WebSocket proxy when a Sec-Websocket-Protocol header contained an allowed field name without the required ‘+’ delimiter, causing an index-out-of-range error during forwarding. It also changed parsing to treat the header as a comma-separated list of sub-protocols, preventing a bare protocol name from absorbing an unrelated sub-protocol’s value. Separately, the same PR bounds incoming WebSocket message sizes with MaxWsMsgSize, rejecting oversized frames at the header instead of reading them fully.
Changed components
REST WebSocket proxySec-Websocket-Protocol header handlingincoming WebSocket message framingInspect captured patch +15 / −0
### docs/release-notes/release-notes-0.21.3.md
@@ -69,6 +69,14 @@
* [Fixed an issue](https://github.com/lightningnetwork/lnd/pull/11140) where the
incoming side of a forwarded dust HTLC could remain stuck.
+* [Fixed a panic](https://github.com/lightningnetwork/lnd/pull/11122) in the
+ REST WebSocket proxy, where a `Sec-Websocket-Protocol` header carrying an
+ allowed field name without the `+` delimiter caused an index out of range
+ while the header was being forwarded to the backend. The header is now parsed
+ as the comma separated list of sub protocols it is, so a bare protocol name
+ can also no longer pick up the value of an unrelated sub protocol in the same
+ list.
+
# New Features
## Functional Enhancements
@@ -102,6 +110,12 @@
## Functional Updates
+* The REST WebSocket proxy now [bounds the size of incoming
+ messages](https://github.com/lightningnetwork/lnd/pull/11122) using
+ `MaxWsMsgSize`, the limit that was already applied to the responses it writes
+ back out. Oversized frames are rejected from their header rather than read in
+ full.
+
## RPC Updates
## lncli Updates
@@ -132,6 +146,7 @@
* Boris Nagaev
* Elle Mouton
+* Gijs van Dam
* LNBiG
* Yong Yu
* ZiggieWhy this scored 46/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.