CVE-2026-35405 Details
Description
libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, libp2p-rendezvous server has no limit on how many namespaces a single peer can register. A malicious peer can just keep registering unique namespaces in a loop and the server happily accepts every single one allocating memory for each registration with no pushback. Keep doing this long enough (or with multiple sybil peers) and the server process gets OOM killed. This vulnerability is fixed in 0.17.1.
A denial-of-service vulnerability has been identified in the libp2p Rust implementation, specifically in the rendezvous server prior to version 0.17.1. The issue arises from the server's lack of a limit on the number of namespaces a single peer can register. This flaw allows a malicious peer to continuously register unique namespaces, with the server accepting each one and allocating memory for the registrations without any resistance. If this process is repeated enough times, or if multiple sybil peers are used, the server can exhaust its memory resources and be killed by the operating system.
Users can upgrade to libp2p version 0.17.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-cqfx-gf56-8x59 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-cqfx-gf56-8x59 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| protocol libp2p | < 0.17.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 24, 2026 | Initial Analysis | [email protected] |
| Apr 9, 2026 | CVE Modified | CISA-ADP |
| Apr 7, 2026 | New CVE Received | [email protected] |