CVE-2026-35457— libp2p-rust has unbounded rendezvous DISCOVER cookies enable remote memory exhaustion
Quick assessment
Affected
libp2p rust-libp2p
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
rust-libp2p是libp2p开源的一种 libp2p 网络堆栈的 Rust 实现。 rust-libp2p 0.17.1之前版本存在安全漏洞，该漏洞源于会合服务器存储分页cookie时未设置边界，可能导致未经身份验证的对等节点通过重复发出DISCOVER请求，造成无限制的内存增长。
Possible ATT&CK Techniques 2 AI
T1499 · Endpoint Denial of Service T1498 · Network Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-35457
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
libp2p-rust has unbounded rendezvous DISCOVER cookies enable remote memory exhaustion
Source: CVE Program / CVE List V5
Vulnerability Description
libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, the rendezvous server stores pagination cookies without bounds. An unauthenticated peer can repeatedly issue DISCOVER requests and force unbounded memory growth. This vulnerability is fixed in 0.17.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5
Vulnerability Title
rust-libp2p 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
rust-libp2p是libp2p开源的一种 libp2p 网络堆栈的 Rust 实现。 rust-libp2p 0.17.1之前版本存在安全漏洞，该漏洞源于会合服务器存储分页cookie时未设置边界，可能导致未经身份验证的对等节点通过重复发出DISCOVER请求，造成无限制的内存增长。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| libp2p | rust-libp2p | < 0.17.1 | - |
|
II. Public POCs for CVE-2026-35457
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-35457
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-35457 (1)
IV. Related Vulnerabilities
Same product: rust-libp2p
-
CVE-2026-61544
libp2p-quic: Remote panic via certificate expiry race during -
CVE-2026-35405
libp2p-rendezvous: Unlimited namespace registrations per pee -
CVE-2026-34219
libp2p-gossipsub: Gossipsub PRUNE Backoff Heartbeat Instant -
CVE-2026-33040
libp2p-rust: Gossipsub PRUNE.backoff Duration Overflow -
CVE-2022-23486
libp2p-rust denial of service vulnerability from lack of res
Same vendor: libp2p
-
CVE-2026-86040
libp2p: Unbounded RPC decode + synchronous subscription proc -
CVE-2026-86039
libp2p: PeerStore accepts attacker-signed PeerRecords for a -
CVE-2026-86038
libp2p: Gossipsub StrictSign accepts attacker-signed message -
CVE-2026-61544
libp2p-quic: Remote panic via certificate expiry race during -
CVE-2026-89146
libp2p-rendezvous through 0.17.1 Denial of Service via Unbou
Same weakness: CWE-770
-
CVE-2026-110843
n8n before 2.41.4 and 2.42.1 Unauthenticated Unbounded OAuth -
CVE-2026-109527
Model Context Protocol Python SDK HTTP and OAuth endpoints a -
CVE-2026-108395
Model Context Protocol Java SDK HTTP server transports allow -
CVE-2026-102048
Junos OS: An attacker causes l2cpd crash when FNP is used wi -
CVE-2026-101971
Junos OS and Junos OS Evolved: An attacker causes routing pr
V. Comments for CVE-2026-35457
No comments yet