CVE-2026-35405CWE-770

libp2p-rendezvous: Unlimited namespace registrations per peer enables OOM DoS on rendezvous servers

High · published April 7, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
40.9
In the wild
Unconfirmed
What it is

libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, libp2p-rendezvous server has no limit on how many namespaces a single peer can register. A malicious peer can just keep registering unique namespaces in a loop and the server happily accepts every single one allocating memory for each registration with no pushback. Keep doing this long enough (or with multiple sybil peers) and the server process gets OOM killed. This vulnerability is fixed in 0.17.1.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00486 · 40.9th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-04-07T14:21Z
EPSS history
Timeline
  • 07 APR 14:21Z
    libp2p-rendezvous: Unlimited namespace registrations per peer enables OOM DoS on rendezvous servers
    cvelistv5