Monero Node Ops Brief: November 13, 2026

Research window: November 6 to 13, 2026. Status checked November 13 at 18:26 UTC.

Monero proposals opened November 10 address RPC workload limits and peer-hostname DNS resolution. Both remain open and unmerged. Neither establishes active exploitation or protection in a released version.

Restricted RPC histogram workload

PR #11722 proposes a 100-entry limit on the amounts list in get_output_histogram for restricted HTTP and ZMQ RPC. Unrestricted RPC would remain unchanged.

Contributor test results: kah-ja reports that three clients repeatedly requesting 130,000 amounts raised get_info latency on the same restricted port to about 477 ms without the patch, compared with 1.2 ms with it. The author also reports that the patched restricted handlers accept 100 amounts and reject 101. We have not independently reproduced these measurements. The report describes contributor tests, with no claim of attacks against public nodes.

Affected-version scope: the v0.18.5.4 HTTP handler lacks the proposed count cap, but still contains pay-to-use RPC accounting. The ZMQ handler also lacks that cap. Source inspection confirms these limits are absent in that release. Performance in other configurations and the historical affected-version range remain unverified.

Operator advice: review who can reach restricted RPC and watch request latency under load. Do not rely on restricted mode alone to prevent expensive requests. Do not load-test someone else's public node.

Proxy peer-hostname DNS proposal

PR #11723 would prevent local DNS resolution of configured peer hostnames when operators use --proxy without --proxy-allow-dns-leaks. Its proposed checks reject hostnames that need resolution. They do not add hostname resolution through SOCKS.

Affected-version scope: v0.18.5.4 source handles peer arguments before applying the proxy DNS restrictions. Its hostname helper invokes a local resolver. This supports the concern for configured hostnames on that version, without establishing a complete historical version range.

Operator advice, inferred from the code: if avoiding local DNS is part of your proxy setup, review configured peer names. Numeric peer addresses avoid this hostname lookup, but operators must update stale addresses. Enabling --proxy-allow-dns-leaks explicitly permits local DNS and is not a privacy fix.

The PR has an approving review and a needs backport label. It still awaits merging and a release.

Release status

GitHub's latest Monero release is v0.18.5.4, published October 17, outside this research window. Both changes above remain proposals. Follow their upstream review and later release notes before treating either as an available protection.