CVE-2026-89146

libp2p-rendezvous through 0.17.1 fails to validate registration TTL values in discovery responses, allowing attackers to trigger timer arithmetic overflow. A malicious rendezvous server can send a discovery response with an unbounded TTL value that causes the client node process to panic when...

EUVD-2026-76035

libp2p-rendezvous through 0.17.1 fails to validate registration TTL values in discovery responses, allowing attackers to trigger timer arithmetic overflow. A malicious rendezvous server can send a discovery response with an unbounded TTL value that causes the client node process to panic when...

CVE-2026-89146

CVE-2026-89146 affects the Rust libp2p-rendezvous library (versions through 0.17.1 ). The library fails to validate registration TTL values in discovery responses, so a malicious rendezvous server can send an unbounded TTL that triggers a timer arithmetic overflow , causing the client node proces...

CVE-2026-89146 libp2p-rendezvous through 0.17.1 Denial of Service via Unbounded Registration TTL in Discovery Responses

libp2p-rendezvous through 0.17.1 fails to validate registration TTL values in discovery responses, allowing attackers to trigger timer arithmetic overflow. A malicious rendezvous server can send a discovery response with an unbounded TTL value that causes the client node process to panic when...

CVE-2026-89146 libp2p-rendezvous through 0.17.1 Denial of Service via Unbounded Registration TTL in Discovery Responses

libp2p-rendezvous through 0.17.1 fails to validate registration TTL values in discovery responses, allowing attackers to trigger timer arithmetic overflow. A malicious rendezvous server can send a discovery response with an unbounded TTL value that causes the client node process to panic when...

CVE-2026-89146: Integer Overflow or Wraparound

libp2p-rendezvous through 0.17.1 fails to validate registration TTL values in discovery responses, allowing attackers to trigger timer arithmetic overflow. A malicious rendezvous server can send a discovery response with an unbounded TTL value that causes the client node process to panic when...

PT-2026-89826

libp2p-rendezvous through 0.17.1 fails to validate registration TTL values in discovery responses, allowing attackers to trigger timer arithmetic overflow. A malicious rendezvous server can send a discovery response with an unbounded TTL value that causes the client node process to panic when...

CVE-2026-35405

libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, libp2p-rendezvous server has no limit on how many namespaces a single peer can register. A malicious peer can just keep registering unique namespaces in a loop and the server happily accepts...

CVE-2026-35405

libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, libp2p-rendezvous server has no limit on how many namespaces a single peer can register. A malicious peer can just keep registering unique namespaces in a loop and the server happily accepts...

CVE-2026-35405

CVE-2026-35405 (libp2p-rendezvous) : The Red Hat/NVD et al. documents describe a vulnerability in libp2p-rendezvous where the server has no limit on how many namespaces a single peer can register. As a result, a malicious or multiple sybil peers can repeatedly register unique namespaces, each reg...

CVE-2026-35405 libp2p-rendezvous: Unlimited namespace registrations per peer enables OOM DoS on rendezvous servers

libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, libp2p-rendezvous server has no limit on how many namespaces a single peer can register. A malicious peer can just keep registering unique namespaces in a loop and the server happily accepts...

fuel-p2p (>=0.4.0, <=0.5.0), libp2p (>=0.40.0-rc.1, <=0.42.2) +1 more potentially affected by CVE-2026-35457 via libp2p-rendezvous (>=0.1.0, <=0.3.0)

libp2p-rendezvous CARGO version =0.1.0, =0.4.0, =0.40.0-rc.1, =0.20.0, =0.21.0 Source cves: CVE-2026-35457 Source advisory: OSV:GHSA-V5HW-CV9C-RPG7...

fuel-p2p (>=0.4.0, <=0.5.0), libp2p (>=0.40.0-rc.1, <=0.42.2) +1 more potentially affected by CVE-2026-35405 via libp2p-rendezvous (>=0.1.0, <=0.3.0)

libp2p-rendezvous CARGO version =0.1.0, =0.4.0, =0.40.0-rc.1, =0.20.0, =0.21.0 Source cves: CVE-2026-35405 Source advisory: OSV:GHSA-CQFX-GF56-8X59...

GHSA-CQFX-GF56-8X59 libp2p-rendezvous: Unlimited namespace registrations per peer enables OOM DoS on rendezvous servers

Summary found that libp2p-rendezvous server has no limit on how many namespaces a single peer can register. a malicious peer can just keep registering unique namespaces in a loop and the server happily accepts every single one allocating memory for each registration with no pushback. keep doing...