CVE-2026-35405

found that libp2p-rendezvous server has no limit on how many namespaces a single peer can register. a malicious peer can just keep registering unique namespaces in a loop and the server happily accepts every single one allocating memory for each registration with no pushback. keep doing this long enough (or with multiple sybil peers) and the server process gets OOM killed.

no auth required. any peer on the network can do this.

Details

the bug is in Registrations::add() inside protocols/rendezvous/src/server.rs.

the store uses a BiMap keyed on (PeerId, Namespace) so yes, a peer can't register the same namespace twice. but there's nothing stopping it from registering 10,000 different namespaces. each unique one gets its own entry in:

• registrations_for_peer (BiMap)
• registrations (HashMap)
• next_expiry (FuturesUnordered a new heap-allocated BoxFuture per registration)

namespace strings are only validated for length (MAX_NAMESPACE = 255), not count. there's no max_registrations_per_peer anywhere in Config or the rest of the codebase.

making it worse MAX_TTL = 72 hours. so every registration just sits there for up to 3 days. disconnecting doesn't clean anything up either, entries only go away when the TTL fires.

protocols/rendezvous/src/server.rs
  └── Registrations::add()   ← no per-peer count check anywhere

protocols/rendezvous/src/lib.rs
  ├── MAX_NAMESPACE = 255    ← length capped, count is not
  └── MAX_TTL = 72h          ← entries persist a long time

fix would be adding something like max_registrations_per_peer to Config and checking it at the top of add() before inserting anything.

PoC

tested on libp2p v0.56.1, built from source.

step 1 - start the rendezvous server (uses the example from the repo):

cargo run --manifest-path examples/rendezvous/Cargo.toml --bin rendezvous-example

step 2 - run the flood client (attached as rzv-flood.rs):

cargo run --manifest-path examples/rendezvous/Cargo.toml --bin rzv-flood

it connects as a single peer and registers 10,000 unique namespaces (flood-00000000 through flood-00009999), chaining each registration on the confirmed Registered event from the previous one.

server accepted every single one. not one rejection.

memory on the server side (via ps aux RSS column):

baseline:       ~18 MB
mid flood:      ~26 MB  
after 10k regs: ~28 MB

that's from one peer. scale to 100 sybil peers doing the same thing and you're looking at ~1GB. 1000 peers and the server is dead.

server RSS climbing during the flood

10,000 registrations confirmed, zero rejected

Researchers

Discovered by:

• Ramesh Adhikari (CoE-CNDS Lab, VJTI, Mumbai, India)
• Dr. Faruk Kazi (CoE-CNDS Lab, VJTI, Mumbai, India)

Organization: Centre of Excellence in Complex & Nonlinear Dynamical Systems (CoE-CNDS Lab), Veermata Jijabai Technological Institute (VJTI), Mumbai, India

We have not disclosed this to any other vendor or made it public. We are reporting directly to the rust-libp2p security team through this advisory.

any node running libp2p-rendezvous server-side is affected. rendezvous servers are typically well-known, publicly reachable nodes taking one down disrupts peer discovery for all clients depending on it. any rust-libp2p based project that deploys a rendezvous point is at risk.

no special position on the network needed. no crypto work. just open a connection and send REGISTER in a loop.

The application allocates resources such as memory, threads, or file descriptors based on untrusted input without enforcing a cap. Typical impact: resource exhaustion leading to denial of service.

CVE-2026-35405 has a CVSS score of 7.5 (High). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.17.1); upgrading removes the vulnerable code path.

Kodem intelligence

1. What is CVE-2026-35405? CVE-2026-35405 is a high-severity allocation of resources without limits or throttling vulnerability in libp2p-rendezvous (rust), affecting versions < 0.17.1. It is fixed in 0.17.1. The application allocates resources such as memory, threads, or file descriptors based on untrusted input without enforcing a cap.
2. How severe is CVE-2026-35405? CVE-2026-35405 has a CVSS score of 7.5 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of libp2p-rendezvous are affected by CVE-2026-35405? libp2p-rendezvous (rust) versions < 0.17.1 is affected.
4. Is there a fix for CVE-2026-35405? Yes. CVE-2026-35405 is fixed in 0.17.1. Upgrade to this version or later.
5. Is CVE-2026-35405 exploitable, and should I be worried? Whether CVE-2026-35405 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-35405 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-35405? Upgrade libp2p-rendezvous to 0.17.1 or later.