CVE-2026-89146

libp2p-rendezvous through 0.17.1 fails to validate registration TTL values in discovery responses, allowing attackers to trigger timer arithmetic overflow. A malicious rendezvous server can send a discovery response with an unbounded TTL value that causes the client node process to panic when...

CVE-2026-89146 libp2p-rendezvous through 0.17.1 Denial of Service via Unbounded Registration TTL in Discovery Responses

libp2p-rendezvous through 0.17.1 fails to validate registration TTL values in discovery responses, allowing attackers to trigger timer arithmetic overflow. A malicious rendezvous server can send a discovery response with an unbounded TTL value that causes the client node process to panic when...

CVE-2026-89146

CVE-2026-89146 affects the Rust libp2p-rendezvous library (versions through 0.17.1 ). The library fails to validate registration TTL values in discovery responses, so a malicious rendezvous server can send an unbounded TTL that triggers a timer arithmetic overflow , causing the client node proces...