{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35405", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-02T17:03:42.075Z", "datePublished": "2026-04-07T14:21:15.377Z", "dateUpdated": "2026-04-07T14:21:15.377Z"}, "containers": {"cna": {"title": "libp2p-rendezvous: Unlimited namespace registrations per peer enables OOM DoS on rendezvous servers", "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-cqfx-gf56-8x59", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-cqfx-gf56-8x59"}], "affected": [{"vendor": "libp2p", "product": "rust-libp2p", "versions": [{"version": "< 0.17.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-07T14:21:15.377Z"}, "descriptions": [{"lang": "en", "value": "libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, libp2p-rendezvous server has no limit on how many namespaces a single peer can register. A malicious peer can just keep registering unique namespaces in a loop and the server happily accepts every single one allocating memory for each registration with no pushback. Keep doing this long enough (or with multiple sybil peers) and the server process gets OOM killed. This vulnerability is fixed in 0.17.1."}], "source": {"advisory": "GHSA-cqfx-gf56-8x59", "discovery": "UNKNOWN"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, libp2p-rendezvous server has no limit on how many namespaces a single peer can register. A malicious peer can just keep registering unique namespaces in a loop and the server happily accepts every single one allocating memory for each registration with no pushback. Keep doing this long enough (or with multiple sybil peers) and the server process gets OOM killed. This vulnerability is fixed in 0.17.1."}], "id": "CVE-2026-35405", "lastModified": "2026-04-08T21:27:15.610", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-04-07T15:17:43.367", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-cqfx-gf56-8x59"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.17.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "rust-libp2p", "vendor": "libp2p"}], "analysis": {"en": {"generated_at": "2026-04-07T20:21:18.072434+00:00", "value": {"mitigation_remediation": ["Upgrade rust\u2011libp2p to version 0.17.1 or newer to apply the official patch."], "summary": {"action": "Apply Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The affected component is the libp2p\u2011rendezvous server implemented in the Rust libp2p networking stack. Versions prior to 0.17.1 are susceptible. Any system running the server in this version range is at risk.", "description_and_impact": "The vulnerability lies in the libp2p\u2011rendezvous server\u2019s lack of enforcement on namespace registrations. A malicious peer can repeatedly register unique namespaces, each registration allocating memory on the server without any limits. This unbounded growth can consume all available memory, ultimately leading to an out\u2011of\u2011process termination of the server. The core weakness is an uncontrolled resource consumption error, identified as CWE\u2011770. The impact manifests as service disruption, denying legitimate peers from utilizing the rendezvous service.", "risk_and_exploitability": "The CVSS score of 7.5 indicates a high severity for this resource exhaustion flaw. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited publicly known exploitation. Based on the description, the likely attack vector is a remote peer connecting to the rendezvous server and issuing namespace registration requests, which the server accepts unconditionally, allowing a distributed or single adversary to trigger service failure."}}}}, "created": "2026-04-08T19:49:07.978877+00:00", "updated": "2026-04-09T08:24:22.900167+00:00", "vendors": ["libp2p", "libp2p$PRODUCT$rust-libp2p"]}