CVE-2026-89146: falha de alta gravidade em libp2p-rendezvous
libp2p-rendezvous through 0.17.1 Denial of Service via Unbounded Registration TTL in Discovery Responses
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.7epss 0.6%
libp2p-rendezvous through 0.17.1 fails to validate registration TTL values in discovery responses, allowing attackers to trigger timer arithmetic overflow. A malicious rendezvous server can send a discovery response with an unbounded TTL value that causes the client node process to panic when computing the expiry timer.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
libp2p · libp2p-rendezvousReferências
https://docs.rs/crate/libp2p-rendezvous/0.17.1/source/src/client.rshttps://gist.github.com/thesmartshadow/25ef03f7ebbd12118a9d27695c885989https://github.com/libp2p/rust-libp2phttps://www.vulncheck.com/advisories/libp2p-rendezvous-through-0.17.1-denial-of-service-via-unbounded-registration-ttl-in-discovery-responses