1 line
1.8 KiB
JSON
1 line
1.8 KiB
JSON
{"schema_version":"1.9.2","id":"RUSTSEC-2026-0526","published":"2026-04-02T12:00:00Z","modified":"2026-11-13T12:45:06.633405487Z","aliases":["CVE-2026-35405","GHSA-cqfx-gf56-8x59"],"summary":"Rendezvous server accepted unlimited registrations per peer","details":"The rendezvous server's registration store did not limit how many namespaces a single peer could register, or how many registrations it held in total. Each registration stays until its TTL expires, up to 72 hours, and is not removed when the peer disconnects. An unauthenticated peer can send REGISTER requests for new namespaces in a loop, and many peers together can exhaust the server's memory, cutting off discovery for every client that relies on it.\n\nThe fix adds limits on registrations per peer (32 by default) and in total (10,000 by default), configurable through `Config`, and answers requests over the limit with an `Unavailable` error. It is in 0.17.1.","affected":[{"package":{"name":"libp2p-rendezvous","ecosystem":"crates.io","purl":"pkg:cargo/libp2p-rendezvous"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.17.1"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["denial-of-service"],"cvss":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0526.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/libp2p-rendezvous"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0526.html"},{"type":"WEB","url":"https://github.com/libp2p/rust-libp2p/commit/8fde2dc0fae8b433f97c6cdf9ee24f59d51a359c"}],"database_specific":{"license":"CC0-1.0"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]} |