Executive brief
A vulnerability in the libp2p-rendezvous server allows an attacker to crash the service by exhausting its memory. The server, which helps different devices find each other on a network, fails to limit how many 'namespaces' a single user can register. By repeatedly registering new names, an attacker can force the server to run out of memory and shut down, disrupting peer discovery for all users of the network.
Technical details
A resource exhaustion vulnerability exists in the `Registrations::add()` function within `protocols/rendezvous/src/server.rs`. While the server validates the length of individual namespace strings, it does not enforce a maximum count of unique namespaces a single PeerId can register. An unauthenticated attacker can programmatically register thousands of unique namespaces, each resulting in new heap allocations in `registrations_for_peer` (BiMap), `registrations` (HashMap), and `next_expiry` (FuturesUnordered). Because registrations persist for up to 72 hours (MAX_TTL) and are not cleared upon peer disconnection, a single attacker or a small number of Sybil nodes can trigger an Out-of-Memory (OOM) condition. This is fixed in version 0.17.1 by introducing a configurable limit on registrations per peer.
Affected products
- libp2p libp2p-rendezvous < 0.17.1
Timeline
- 2026-04-02: disclosed: Initial disclosure to the rust-libp2p security team.
- 2026-04-04: advisory: GitHub Advisory GHSA-cqfx-gf56-8x59 published.
- 2026-04-07: other: NVD published CVE-2026-35405.