common: bound untrusted inputs and address parsing (v26.06.7 security, 4/7) - #9510

Merged

nGoline merged 8 commits into

ElementsProject:masterfrom

nGoline:port-26.06.7-input-bounds

Sep 15, 2026

Commits on Sep 15, 2026

pytest: check the SOCKS5 request for a maximum-length hostname
nGoline
committed
98b95b2
connectd: bound the SOCKS5 request hostname to the request buffer
nGoline
committed
19339de
common: ignore DNS address descriptors which are not hostnames
nGoline
committed
ed77b9e
common: reject dns: addresses which are not hostnames
nGoline
committed
e25575d
common: bound JSON nesting depth when parsing
nGoline
committed
9a744dd
clnrest: restrict maximum size of request bodies to 2MiB

daywalker90
authored and
nGoline
committed
1630f62
tests: add clnrest test for large request bodies

daywalker90
authored and
nGoline
committed
966d828
common: fix tlv_span returning huge length for out-of-range stream

nGoline
and
claude
committed
4e3dce8