RUSTSEC-2026-0365

Summary

The negentropy crate is vulnerable to denial-of-service through an unchecked, peer-controlled ID count in reconciliation messages.

With the std feature enabled, which is the default configuration, a small malformed message can trigger an enormous memory allocation and terminate the application.

Details

When processing an IdList range, the reconciliation parser uses the peer-provided ID count to reserve memory before checking whether the message contains the corresponding IDs:

let mut their_elems: HashSet<Id> =
    HashSet::with_capacity(num_ids as usize);

An attacker can declare an arbitrarily large count without supplying any IDs. The allocation occurs before the parser reaches the ID-reading loop, which would otherwise reject the truncated message.

With Rust's default allocation-error behavior, a failed allocation aborts the process rather than unwinding. Consequently, catch_unwind cannot contain the failure.

Both reconcile and reconcile_with_ids reach the vulnerable parser.

The patched versions validate the count against the remaining message length before allocating:

if num_ids > (query.len() / ID_SIZE) as u64 {
    return Err(Error::ParseEndsPrematurely);
}

Impact

An unauthenticated remote attacker can terminate an application that exposes reconciliation to untrusted peers without additional validation.

For example, a Nostr relay that forwards NEG-OPEN or NEG-MSG reconciliation payloads to the vulnerable parser can be taken down by a single client message. Clients processing messages from malicious relays are also exposed.

This specific vulnerability affects builds with the default std feature enabled. Builds without std use a BTreeSet and do not perform the vulnerable preallocation.

A message-size limit alone does not prevent exploitation because the malicious payload can be only a few bytes long.

Credit

Discovered and fixed by Alex Gleason (https://github.com/alexgleason).