Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2026-35405: libp2p-rendezvous servers can run out of memory
CVE-2026-35405 · published 7 months ago
Summary
The libp2p‑rendezvous component used in the jxs/libp2p-rendezvous and protocol/libp2p packages allowed any client to create unlimited named groups, each consuming memory. A malicious client could keep adding new groups until the server ran out of memory and stopped working. Updating to version 0.17.1, which adds a limit on registrations, resolves the issue.
What to do
- Update jxs libp2p-rendezvous to version 0.17.1.
- Update protocol libp2p to version 0.17.1 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| rust | jxs | libp2p-rendezvous |
< 0.17.1 Fix: upgrade to 0.17.1
|
| – | protocol | libp2p |
< 0.17.1 cpe:2.3:a:protocol:libp2p:*:*:*:*:*:rust:*:* |
Original advisory text
libp2p-rendezvous: Unlimited namespace registrations per peer enables OOM DoS on rendezvous servers
libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, libp2p-rendezvous server has no limit on how many namespaces a single peer can register. A malicious peer can just keep registering unique namespaces in a loop and the server happily accepts every single one allocating memory for each registration with no pushback. Keep doing this long enough (or with multiple sybil peers) and the server process gets OOM killed. This vulnerability is fixed in 0.17.1.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-770Allocation of Resources Without Limits
Timeline
Published7 Apr 2026
Updated4 Nov 2026
First seen4 Apr 2026
Track software like this
Free during beta