{"id":"CVE-2026-35457","state":"PUBLISHED","title":"libp2p-rust has unbounded rendezvous DISCOVER cookies enable remote memory exhaustion","description":"libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, the rendezvous server stores pagination cookies without bounds. An unauthenticated peer can repeatedly issue DISCOVER requests and force unbounded memory growth. This vulnerability is fixed in 0.17.1.","publishedAt":"2026-04-07T14:22:19.941Z","updatedAt":"2026-04-07T17:53:37.355Z","severity":{"score":8.2,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","source":"GitHub_M"},"assigner":"GitHub_M","products":["libp2p rust-libp2p"],"affected":[{"vendor":"libp2p","product":"rust-libp2p","versions":[{"version":"< 0.17.1","status":"affected"}]}],"references":["https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-v5hw-cv9c-rpg7"],"weaknesses":["CWE-770"],"ingestedAt":"2026-10-29T20:11:40.391Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/35xxx/CVE-2026-35457.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-35457","state":"PUBLISHED","datePublished":"2026-04-07T14:22:19.941Z","dateUpdated":"2026-04-07T17:53:37.355Z","assignerShortName":"GitHub_M","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateReserved":"2026-04-02T19:25:52.193Z"},"containers":{"cna":{"title":"libp2p-rust has unbounded rendezvous DISCOVER cookies enable remote memory exhaustion","descriptions":[{"lang":"en","value":"libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, the rendezvous server stores pagination cookies without bounds. An unauthenticated peer can repeatedly issue DISCOVER requests and force unbounded memory growth. This vulnerability is fixed in 0.17.1."}],"affected":[{"vendor":"libp2p","product":"rust-libp2p","versions":[{"version":"< 0.17.1","status":"affected"}]}],"references":[{"url":"https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-v5hw-cv9c-rpg7","name":"https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-v5hw-cv9c-rpg7","tags":["x_refsource_CONFIRM"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-770","lang":"en","description":"CWE-770: Allocation of Resources Without Limits or Throttling","type":"CWE"}]}],"providerMetadata":{"shortName":"GitHub_M","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateUpdated":"2026-04-07T14:22:19.941Z"},"source":{"advisory":"GHSA-v5hw-cv9c-rpg7","discovery":"UNKNOWN"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-04-07T17:53:22.542830Z","id":"CVE-2026-35457","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-04-07T17:53:37.355Z"}}]}}}