The XRP Ledger released the xrpld 3.2.1 hotfix on July 31 after identifying a validator manifest flooding issue that affected network nodes. Ripple Director of Engineering Vijay Khanna urged XRPL operators on Aug. 1–2 to install the update immediately to protect their infrastructure.

Throughout the incident, the ledger continued operating as expected, with no reported loss of funds and no disruption to consensus. However, nodes that have not applied the patch remain exposed to potential resource exhaustion problems until operators complete the full two-stage upgrade process.

The announcement came as XRP declined 1.5% over the previous 24 hours, falling from $1.10 to $1.06, while daily trading volume stood at approximately $791 million. The move extended XRP’s recent weakness, with the token down about 4% over the past seven days.

The XRPL Manifest Flood Vulnerability Explained

The issue originated from how XRPL nodes handled validator manifests. Before the release of xrpld 3.2.1, nodes could accept, store, and distribute unlimited validator manifests connected to unknown validator keys, without sufficient controls on data volume or storage usage.

An attacker could exploit this weakness by producing large quantities of unnecessary manifests, forcing nodes to spend excessive computing resources on processing, storing, and transmitting data that would ultimately have no effect on network operations.

The attack resembled a denial-of-service resource exhaustion event rather than a consensus attack. While node resources could be depleted, the XRP Ledger’s transaction processing and consensus mechanisms remained unaffected.

Developers confirmed that the vulnerability was specifically related to validator manifest handling in XRPLF nodes. However, the team has not yet published the complete technical details behind the exploit, including the attacker’s approach and the extent of malicious activity.

XRPL Operations is preparing a detailed post-mortem that is expected to provide further information about the incident, including traffic patterns, attacker behavior, and additional security improvements.

The vulnerability demonstrates a broader blockchain security issue: supporting systems outside the core consensus layer can still become targets when data processing limits are insufficient.

Four Protections Added in xrpld 3.2.1

The latest hotfix introduces four safeguards designed to prevent similar validator manifest flooding attacks.

The update now rejects oversized manifests before they are fully decoded, limits the number of incoming manifests allowed in each network message, reduces the amount of manifest information shared with new peers, and restricts the unknown-validator manifest cache to a maximum of 100 entries.

The patch also changes storage behavior by preventing unknown validator manifests from being written to disk. This means any malicious manifest data collected before the upgrade will be removed after a restart instead of remaining stored locally.

Because of this change, operators must complete a specific two-step upgrade sequence.

First, node operators need to install xrpld 3.2.1 and allow the server to run for one to two minutes. They must then perform a second restart to clear any manifest data that was retained before the update.

Skipping the second restart could leave older flood-related data on the system and prevent the patch from fully addressing the issue.

Operators are also advised to confirm that their systems recognize Ripple’s updated GPG signing key, which was rotated on Feb. 18, 2026. If the correct key is missing, automated upgrade processes may fail without providing a visible error.