Vulnerability · Published Apr 7, 2026 · Assigned by GitHub_M

CVE-2026-35405libp2p-rendezvous: Unlimited namespace registrations per peer enables OOM DoS on rendezvous servers

High 7.5

In plain English

A high-severity resource allocation without limits in rust-libp2p from libp2p. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.4%top 64.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, libp2p-rendezvous server has no limit on how many namespaces a single peer can register. A malicious peer can just keep registering unique namespaces in a loop and the server happily accepts every single one allocating memory for each registration with no pushback. Keep doing this long enough (or with multiple sybil peers) and the server process gets OOM killed. This vulnerability is fixed in 0.17.1.

Affected products (as reported)

Vendor	Product	Versions
libp2p	rust-libp2p	< 0.17.1

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-cqfx-gf56-8x59 x_refsource_CONFIRM