CVE-2026-89146— libp2p-rendezvous through 0.17.1 Denial of Service via Unbounded Registration TTL in Discovery Responses
Quick assessment
Affected
libp2p libp2p-rendezvous
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
libp2p-rendezvous是libp2p组织开源的一个提供点对点网络节点注册与发现服务的中间件。 libp2p-rendezvous 0.17.1及之前版本存在安全漏洞，该漏洞源于未验证发现响应中的注册TTL值，可能导致定时器算术溢出，恶意rendezvous服务器可发送无界TTL值使客户端节点进程在计算到期计时器时崩溃。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| libp2p | libp2p-rendezvous | ≤ 0.17.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-89146
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
libp2p-rendezvous through 0.17.1 Denial of Service via Unbounded Registration TTL in Discovery Responses
Source: CVE Program / CVE List V5
Vulnerability Description
libp2p-rendezvous through 0.17.1 fails to validate registration TTL values in discovery responses, allowing attackers to trigger timer arithmetic overflow. A malicious rendezvous server can send a discovery response with an unbounded TTL value that causes the client node process to panic when computing the expiry timer.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
整数溢出或超界折返
Source: CVE Program / CVE List V5
Vulnerability Title
libp2p-rendezvous 数字错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
libp2p-rendezvous是libp2p组织开源的一个提供点对点网络节点注册与发现服务的中间件。 libp2p-rendezvous 0.17.1及之前版本存在安全漏洞，该漏洞源于未验证发现响应中的注册TTL值，可能导致定时器算术溢出，恶意rendezvous服务器可发送无界TTL值使客户端节点进程在计算到期计时器时崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| libp2p | libp2p-rendezvous | 0 ~ 0.17.1 | - |
|
II. Public POCs for CVE-2026-89146
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-89146
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-89146 (1)
Proof of Concept for CVE-2026-89146 (1)
Vendor Pages for CVE-2026-89146 (1)
Other References for CVE-2026-89146 (1)
IV. Related Vulnerabilities
Same vendor: libp2p
-
CVE-2026-95859
libp2p-rust: Gossipsub GRAFT topics unbounded growth -
CVE-2026-103936
libp2p: Single pre-auth STUN packet terminates `@libp2p/webr -
CVE-2026-86040
libp2p: Unbounded RPC decode + synchronous subscription proc -
CVE-2026-86039
libp2p: PeerStore accepts attacker-signed PeerRecords for a -
CVE-2026-86038
libp2p: Gossipsub StrictSign accepts attacker-signed message
Same weakness: CWE-190
-
CVE-2026-62438
Gimp: gimp: paa integer overflow out-of-bounds read -
CVE-2026-62439
Gimp: gimp: file-pvr plug-in pvr file parsing integer overfl -
CVE-2026-102834
JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infi -
CVE-2026-102692
RIOT: Potential integer overflow in nanocoap Block2 handling -
CVE-2026-57488
pupnp: Integer truncation in HTTP Content-Length parsing ena
V. Comments for CVE-2026-89146
No comments yet