On August 2, Ripple’s Director of Engineering Vijay Khanna urged XRP Ledger node operators to upgrade to xrpld version 3.2.1 following a surge in validator manifest messages on July 31. This unexpected flood pushed the network to implement a hotfix aimed at preventing resource overload caused by unrecognized validator identities.
Validator manifests serve to link a validator’s permanent identity to temporary keys used daily. When these keys rotate, new manifests are published for verification by peers. Before the fix, nodes accepted and rebroadcast manifests from unknown validators, which attackers exploited by flooding the network with fake manifests. This forced nodes to waste memory, bandwidth, and processing power, threatening network stability.
New safeguards to protect node resources
The release of xrpld 3.2.1 on July 31 introduced four key measures to limit this attack vector. First, nodes now reject oversized validator manifests before decoding them fully, reducing processing demand. Other safeguards cap message batch sizes, control outbound data sharing, and restrict cache growth for unknown keys across the network. Operators are advised to upgrade immediately, verify the node is running the new version, and restart to clear any persisted manifests safely.
Despite the manifest flood, XRP Ledger maintained normal ledger closings without any reported financial losses or disruptions to transaction consensus, according to XRP Ledger Operations. While no CVE identifier or damage estimate has been issued, the incident highlighted vulnerabilities in how nodes handle unknown validator data. This hotfix is a key step to safeguard the network against similar attacks in the future.
