CVE-2026-35457CWE-770

libp2p-rust has unbounded rendezvous DISCOVER cookies enable remote memory exhaustion

High · published April 7, 2026

CVSS v3.1
8.2
EPSS
0%
Percentile
35.6
In the wild
Unconfirmed
What it is

libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, the rendezvous server stores pagination cookies without bounds. An unauthenticated peer can repeatedly issue DISCOVER requests and force unbounded memory growth. This vulnerability is fixed in 0.17.1.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00424 · 35.6th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-04-07T14:22Z
EPSS history
Timeline
  • 07 APR 14:22Z
    libp2p-rust has unbounded rendezvous DISCOVER cookies enable remote memory exhaustion
    cvelistv5