Vulnerability · Published Apr 7, 2026 · Assigned by GitHub_M
CVE-2026-35457libp2p-rust has unbounded rendezvous DISCOVER cookies enable remote memory exhaustion
High 8.2
In plain English
A high-severity resource allocation without limits in rust-libp2p from libp2p. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).
Severity (CVSS 3.1)8.2High
Exploit odds (30 days)0.3%top 77.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, the rendezvous server stores pagination cookies without bounds. An unauthenticated peer can repeatedly issue DISCOVER requests and force unbounded memory growth. This vulnerability is fixed in 0.17.1.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| libp2p | rust-libp2p | < 0.17.1 |
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
References
- https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-v5hw-cv9c-rpg7 x_refsource_CONFIRM