CVE-2026-35405

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35405", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-02T17:03:42.075Z", "datePublished": "2026-04-07T14:21:15.377Z", "dateUpdated": "2026-04-09T17:44:08.836Z"}, "containers": {"cna": {"title": "libp2p-rendezvous: Unlimited namespace registrations per peer enables OOM DoS on rendezvous servers", "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-cqfx-gf56-8x59", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-cqfx-gf56-8x59"}], "affected": [{"vendor": "libp2p", "product": "rust-libp2p", "versions": [{"version": "< 0.17.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-07T14:21:15.377Z"}, "descriptions": [{"lang": "en", "value": "libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, libp2p-rendezvous server has no limit on how many namespaces a single peer can register. A malicious peer can just keep registering unique namespaces in a loop and the server happily accepts every single one allocating memory for each registration with no pushback. Keep doing this long enough (or with multiple sybil peers) and the server process gets OOM killed. This vulnerability is fixed in 0.17.1."}], "source": {"advisory": "GHSA-cqfx-gf56-8x59", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-cqfx-gf56-8x59", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-09T17:44:02.373442Z", "id": "CVE-2026-35405", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-09T17:44:08.836Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35405", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-02T17:03:42.075Z", "datePublished": "2026-04-07T14:21:15.377Z", "dateUpdated": "2026-04-09T17:44:08.836Z"}, "containers": {"cna": {"title": "libp2p-rendezvous: Unlimited namespace registrations per peer enables OOM DoS on rendezvous servers", "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-cqfx-gf56-8x59", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-cqfx-gf56-8x59"}], "affected": [{"vendor": "libp2p", "product": "rust-libp2p", "versions": [{"version": "< 0.17.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-07T14:21:15.377Z"}, "descriptions": [{"lang": "en", "value": "libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, libp2p-rendezvous server has no limit on how many namespaces a single peer can register. A malicious peer can just keep registering unique namespaces in a loop and the server happily accepts every single one allocating memory for each registration with no pushback. Keep doing this long enough (or with multiple sybil peers) and the server process gets OOM killed. This vulnerability is fixed in 0.17.1."}], "source": {"advisory": "GHSA-cqfx-gf56-8x59", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-35405", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-09T17:44:02.373442Z"}}}], "references": [{"url": "https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-cqfx-gf56-8x59", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-09T17:43:54.490Z"}}]}}

{"affected": [{"affectedData": [{"product": "rust-libp2p", "vendor": "libp2p", "versions": [{"status": "affected", "version": "< 0.17.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:protocol:libp2p:*:*:*:*:*:rust:*:*", "matchCriteriaId": "0EA2FB25-A1F1-4E02-A0C9-0BCC07AFCA5C", "versionEndExcluding": "0.17.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, libp2p-rendezvous server has no limit on how many namespaces a single peer can register. A malicious peer can just keep registering unique namespaces in a loop and the server happily accepts every single one allocating memory for each registration with no pushback. Keep doing this long enough (or with multiple sybil peers) and the server process gets OOM killed. This vulnerability is fixed in 0.17.1."}, {"lang": "es", "value": "libp2p-rust es la implementaci\u00f3n oficial en lenguaje Rust de la pila de red libp2p. Antes de la versi\u00f3n 0.17.1, el servidor libp2p-rendezvous no tiene l\u00edmite en la cantidad de espacios de nombres que un \u00fanico par puede registrar. Un par malicioso puede seguir registrando espacios de nombres \u00fanicos en un bucle y el servidor acepta felizmente cada uno de ellos, asignando memoria para cada registro sin resistencia. Si se hace esto el tiempo suficiente (o con m\u00faltiples pares sybil), el proceso del servidor se termina por falta de memoria. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 0.17.1."}], "id": "CVE-2026-35405", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35405", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-09T17:44:02.373442Z", "version": "2.0.3"}}]}, "published": "2026-04-07T15:17:43.367", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-cqfx-gf56-8x59"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-cqfx-gf56-8x59"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.17.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "rust-libp2p", "vendor": "libp2p"}], "analysis": {"en": {"generated_at": "2026-04-07T20:21:18.072434+00:00", "value": {"mitigation_remediation": ["Upgrade rust\u2011libp2p to version 0.17.1 or newer to apply the official patch."], "summary": {"action": "Apply Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The affected component is the libp2p\u2011rendezvous server implemented in the Rust libp2p networking stack. Versions prior to 0.17.1 are susceptible. Any system running the server in this version range is at risk.", "description_and_impact": "The vulnerability lies in the libp2p\u2011rendezvous server\u2019s lack of enforcement on namespace registrations. A malicious peer can repeatedly register unique namespaces, each registration allocating memory on the server without any limits. This unbounded growth can consume all available memory, ultimately leading to an out\u2011of\u2011process termination of the server. The core weakness is an uncontrolled resource consumption error, identified as CWE\u2011770. The impact manifests as service disruption, denying legitimate peers from utilizing the rendezvous service.", "risk_and_exploitability": "The CVSS score of 7.5 indicates a high severity for this resource exhaustion flaw. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited publicly known exploitation. Based on the description, the likely attack vector is a remote peer connecting to the rendezvous server and issuing namespace registration requests, which the server accepts unconditionally, allowing a distributed or single adversary to trigger service failure."}}}}, "created": "2026-04-08T19:49:07.978877+00:00", "updated": "2026-04-09T08:24:22.900167+00:00", "vendors": ["libp2p", "libp2p$PRODUCT$rust-libp2p"]}