CVE-2026-35405

HIGH

libp2p-rendezvous: Unlimited namespace registrations per peer enables OOM DoS on rendezvous servers

Title source: cna

Description

libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, libp2p-rendezvous server has no limit on how many namespaces a single peer can register. A malicious peer can just keep registering unique namespaces in a loop and the server happily accepts every single one allocating memory for each registration with no pushback. Keep doing this long enough (or with multiple sybil peers) and the server process gets OOM killed. This vulnerability is fixed in 0.17.1.

References (1)

[X_Refsource_Confirm] https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-cqfx-gf56-8x59

Scores

CVSS v3 7.5

EPSS 0.0005

EPSS Percentile 16.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact partial

Details

CWE

CWE-770

Status published

Products (3)

crates.io/libp2p-rendezvous 0 - 0.17.1crates.io

libp2p/rust-libp2p < 0.17.1

protocol/libp2p < 0.17.1

Published Apr 07, 2026

Tracked Since Apr 07, 2026