CVE-2026-35457
libp2p-rust has unbounded rendezvous DISCOVER cookies enable remote memory exhaustion
libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, the rendezvous server stores pagination cookies without bounds. An unauthenticated peer can repeatedly issue DISCOVER requests and force unbounded memory growth. This vulnerability is fixed in 0.17.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
libp2p-rust has unbounded rendezvous DISCOVER cookies enable remote memory exhaustion
libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, the rendezvous server stores pagination cookies without bounds. An unauthenticated peer can repeatedly issue DISCOVER requests and force unbounded memory growth. This vulnerability is fixed in 0.17.1.
- Record
CVE-2026-35457- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
EUVDEUVD-2026-19650
libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, the rendezvous server stores pagination cookies without bounds. An unauthenticated peer can repeatedly issue DISCOVER requests and force unbounded memory growth. This vulnerability is fixed in 0.17.1.
- Record
EUVD-2026-19650- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-v5hw-cv9c-rpg7
libp2p-rendezvous: Unbounded rendezvous DISCOVER cookies enable remote memory exhaustion
Summary
The rendezvous server stores pagination cookies without bounds. An unauthenticated peer can repeatedly issue DISCOVER requests and force unbounded memory growth.
Details
Pagination state is stored in:
HashMap<Cookie, HashSet<RegistrationId>>
On Message::Discover:
remote peer
→ DISCOVER
→ handle_request
→ registrations.get(...)
→ new cookie generated
→ cookie inserted into Registrations::cookies
There is no upper bound or eviction policy, so repeated DISCOVER requests grow this map indefinitely.
PoC
A reproduction test and minimal harness will be provided in a private fork in a follow-up comment.
Impact
Remote state amplification leading to memory exhaustion.
Properties:
- etwork reachable
- no authentication required
- low attack complexity
- protocol-compliant traffic
Impacts rendezvous nodes exposed to untrusted peers.
Possible Fixes
- Global cap + eviction
Bound cookie storage (MAX_COOKIES_TRACKED) with FIFO/expiry aware eviction.
Tradeoff: attacker can churn cookies and evict legitimate pagination state.
- Stateless cookies
Encode pagination state in authenticated cookies instead of storing server-side state.
Tradeoff: more complex implementation.
- Rate limiting / per-peer quotas
Limit cookie creation per peer.
Tradeoff: requires peer tracking.
- Record
GHSA-v5hw-cv9c-rpg7- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
NVD
libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, the rendezvous server stores pagination cookies without bounds. An unauthenticated peer can repeatedly issue DISCOVER requests and force unbounded memory growth. This vulnerability is fixed in 0.17.1.
- Record
CVE-2026-35457- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVGHSA-v5hw-cv9c-rpg7
libp2p-rendezvous: Unbounded rendezvous DISCOVER cookies enable remote memory exhaustion
Summary
The rendezvous server stores pagination cookies without bounds. An unauthenticated peer can repeatedly issue DISCOVER requests and force unbounded memory growth.
Details
Pagination state is stored in:
HashMap<Cookie, HashSet<RegistrationId>>
On Message::Discover:
remote peer
→ DISCOVER
→ handle_request
→ registrations.get(...)
→ new cookie generated
→ cookie inserted into Registrations::cookies
There is no upper bound or eviction policy, so repeated DISCOVER requests grow this map indefinitely.
PoC
A reproduction test and minimal harness will be provided in a private fork in a follow-up comment.
Impact
Remote state amplification leading to memory exhaustion.
Properties:
- etwork reachable
- no authentication required
- low attack complexity
- protocol-compliant traffic
Impacts rendezvous nodes exposed to untrusted peers.
Possible Fixes
- Global cap + eviction
Bound cookie storage (MAX_COOKIES_TRACKED) with FIFO/expiry aware eviction.
Tradeoff: attacker can churn cookies and evict legitimate pagination state.
- Stateless cookies
Encode pagination state in authenticated cookies instead of storing server-side state.
Tradeoff: more complex implementation.
- Rate limiting / per-peer quotas
Limit cookie creation per peer.
Tradeoff: requires peer tracking.
- Record
GHSA-v5hw-cv9c-rpg7- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libp2p-rendezvouscrates.io |
before 0.17.1 | 0.17.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-35457 is a high vulnerability (CVSS 8.2) in Protocol Libp2p, published April 4, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 21st percentile. Fixed in libp2p-rendezvous 0.17.1.