CVE-2026-35457: libp2p-rendezvous Unbounded Rendezvous DISCOVER Cookies Enable Vulnerability

HIGH
Advisory Identifier: GHSA-v5hw-cv9c-rpg7
Share
CVSS 8.2
CWE-770
Published
Advisory Summary

CVE-2026-35457 is a HIGH (CVSS 8.2) unbounded rendezvous discover cookies enable vulnerability (CWE-770: Allocation of Resources Without Limits or Throttling) affecting libp2p-rendezvous libraries in the crates.io ecosystem. The issue involves unbounded rendezvous discover cookies enable remote memory exhaustion. Remediation is available by upgrading affected packages to version 0.17.1.

CVE-2026-35457 at a Glance

CVE Identifier CVE-2026-35457
GHSA Identifier GHSA-v5hw-cv9c-rpg7
Severity HIGH
CVSS v3.1 Base Score 8.2
CWE Classification CWE-770: Allocation of Resources Without Limits or Throttling
Affected Product libp2p-rendezvous
Package Ecosystem crates.io
Published Date
Last Updated

Security Impact

CVSS: 8.2

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality None (C:N)
Integrity Low (I:L)
Availability High (A:H)

How to Fix CVE-2026-35457

To remediate this vulnerability, upgrade all affected libp2p-rendezvous dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

libp2p-rendezvous fixed: 0.17.1 
Upgrade libp2p-rendezvous to 0.17.1
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for libp2p-rendezvous

How to Check if You Are Affected

To determine whether your application is affected by CVE-2026-35457, inspect your project dependencies for libp2p-rendezvous:

inspect dependencies for libp2p-rendezvous

Analyze the terminal output to locate any version of libp2p-rendezvous in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.17.1), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-770: Allocation of Resources Without Limits or Throttling, where the product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. In libp2p-rendezvous, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary The rendezvous server stores pagination cookies without bounds. An unauthenticated peer can repeatedly issue `DISCOVER` requests and force unbounded memory growth. ### Details Pagination state is stored in: ```rs HashMap<Cookie, HashSet<RegistrationId>> ``` On `Message::Discover`: ``` remote peer → DISCOVER → handle_request → registrations.get(...) → new cookie generated → cookie inserted into Registrations::cookies ``` There is **no upper bound or eviction policy**, so repeated DISCOVER requests grow this map indefinitely. ### PoC A reproduction test and minimal harness will be provided in a private fork in a follow-up comment. ### Impact **Remote state amplification leading to memory exhaustion.** Properties: - etwork reachable - no authentication required - low attack complexity - protocol-compliant traffic Impacts rendezvous nodes exposed to untrusted peers. --- ### Possible Fixes 1. **Global cap + eviction** Bound cookie storage (`MAX_COOKIES_TRACKED`) with FIFO/expiry aware eviction. Tradeoff: attacker can churn cookies and evict legitimate pagination state. 2. **Stateless cookies** Encode pagination state in authenticated cookies instead of storing server-side state. Tradeoff: more complex implementation. 3. **Rate limiting / per-peer quotas** Limit cookie creation per peer. Tradeoff: requires peer tracking.

CVE-2026-35457 Affected libp2p-rendezvous Versions

1 component(s)
Fixed Versions:
0.17.1
Product / Package Ecosystem Affected Versions Fixed Version
libp2p-rendezvous
 crates.io
< 0.17.1
0.17.1

References

GitHub Advisory / Wiki ADVISORY
https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-v5hw-cv9c-rpg7
NVD — CVE-2026-35457 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-35457
libp2p-rendezvous Source Repository REPOSITORY
https://github.com/libp2p/rust-libp2p

Frequently Asked Questions

What is CVE-2026-35457?
CVE-2026-35457 is a security vulnerability in libp2p-rendezvous involving Unbounded rendezvous DISCOVER cookies enable remote memory exhaustion under CWE-770: Allocation of Resources Without Limits or Throttling.
Which libp2p-rendezvous versions are affected?
Affected versions include releases prior to 0.17.1 across affected packages: libp2p-rendezvous.
What version fixes CVE-2026-35457?
Upgrading to 0.17.1 (or the latest patched release for your respective branch) resolves the vulnerability.
Is libp2p-rendezvous affected?
Yes, libp2p-rendezvous is affected in releases prior to 0.17.1. Upgrade your dependency to 0.17.1 or later.
What is the CVSS score of CVE-2026-35457?
CVE-2026-35457 has a CVSS v3.1 base score of 8.2 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H.
What CWE is associated with CVE-2026-35457?
CVE-2026-35457 is classified under CWE-770: Allocation of Resources Without Limits or Throttling (The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.).
How can I check crates.io dependencies for CVE-2026-35457?
Run the dependency tree command: 'inspect dependencies for libp2p-rendezvous'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-v5hw-cv9c-rpg7",
  "modified" : "2026-04-07T19:59:51Z",
  "published" : "2026-04-04T06:34:29Z",
  "aliases" : [ "CVE-2026-35457" ],
  "summary" : "libp2p-rendezvous: Unbounded rendezvous DISCOVER cookies enable remote memory exhaustion",
  "details" : "### Summary\nThe rendezvous server stores pagination cookies without bounds. An unauthenticated peer can repeatedly issue `DISCOVER` requests and force unbounded memory growth.\n\n### Details\n\nPagination state is stored in:\n\n```rs\nHashMap<Cookie, HashSet<RegistrationId>>\n```\n\nOn `Message::Discover`:\n\n```\nremote peer\n→ DISCOVER\n→ handle_request\n→ registrations.get(...)\n→ new cookie generated\n→ cookie inserted into Registrations::cookies\n```\n\nThere is **no upper bound or eviction policy**, so repeated DISCOVER requests grow this map indefinitely.\n\n\n### PoC\nA reproduction test and minimal harness will be provided in a private fork in a follow-up comment.\n\n### Impact\n\n**Remote state amplification leading to memory exhaustion.**\n\n\nProperties:\n\n- etwork reachable\n- no authentication required\n- low attack complexity\n- protocol-compliant traffic\n\nImpacts rendezvous nodes exposed to untrusted peers.\n---\n\n### Possible Fixes\n\n1. **Global cap + eviction**\n\nBound cookie storage (`MAX_COOKIES_TRACKED`) with FIFO/expiry aware eviction.  \nTradeoff: attacker can churn cookies and evict legitimate pagination state.\n\n2. **Stateless cookies**\n\nEncode pagination state in authenticated cookies instead of storing server-side state.  \nTradeoff: more complex implementation.\n\n3. **Rate limiting / per-peer quotas**\n\nLimit cookie creation per peer.  \nTradeoff: requires peer tracking.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "crates.io",
      "name" : "libp2p-rendezvous"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.17.1"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-v5hw-cv9c-rpg7"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-35457"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/libp2p/rust-libp2p"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-770" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-04-04T06:34:29Z",
    "nvd_published_at" : "2026-04-07T15:17:43Z"
  }
}