---
# System prepended metadata

title: Untitled

---

Fixing OSV/CVE in lnd (lightning network)

The [lnd](https://github.com/lightningnetwork/lnd), implementation of [lightning network](https://lightning.network), is a payment channel on top of Bitcoin. 

tldr: The master branch of lnd doesn't have any dependencies that have known [OSV](https://osv.dev) or CVE. 




lnd is written in `go`.  The `lnd` version `0.13.3-beta.rc2` had eight OSV's.

https://deps.dev/go/github.com%2Flightningnetwork%2Flnd/v0.13.3-beta.rc2
![](https://i.imgur.com/y1GPpUS.png)

With the latest release all these OSV's have been addressed. All of the OSV's were indirect reference to dependecies.

Almost all of them we all `mod` `replace` directives to avoid using the libraries versions with CVE

* https://github.com/lightningnetwork/lnd/pull/5737
* https://github.com/lightningnetwork/lnd/pull/5789
* https://github.com/lightningnetwork/lnd/pull/5761
* https://github.com/lightningnetwork/lnd/pull/5759
* https://github.com/lightningnetwork/lnd/pull/5738
* https://github.com/fergusstrange/embedded-postgres/pull/42


