Executive brief
libp2p-rendezvous is a peer discovery library used in decentralized networks to help nodes find and connect to each other via rendezvous servers. A malicious rendezvous server can send crafted discovery responses with unbounded TTL (time-to-live) values that cause a client node to crash when calculating expiry timers, disrupting service availability for affected peers.
Technical details
The vulnerability is an arithmetic overflow in TTL validation where libp2p-rendezvous fails to validate or sanitize TTL values received in discovery responses from a rendezvous server. When computing the expiry timer for a discovered registration, the client performs arithmetic on an attacker-controlled TTL value without bounds checking, causing integer overflow in duration calculations. This overflow triggers a panic in the client process. Attack requires network connectivity to a rendezvous server and no authentication is necessary; a malicious or compromised server can exploit any connected client. The fix requires input validation on TTL values before arithmetic operations.
Affected products
- libp2p libp2p-rendezvous through 0.17.1
Timeline
- 2026-09-11: disclosed