1 line
1.6 KiB
JSON
1 line
1.6 KiB
JSON
{"schema_version":"1.9.2","id":"RUSTSEC-2026-0527","published":"2026-04-02T12:00:00Z","modified":"2026-11-13T12:45:06.396596735Z","aliases":["CVE-2026-35457","GHSA-v5hw-cv9c-rpg7"],"summary":"Rendezvous server stored an unlimited number of DISCOVER cookies","details":"Each DISCOVER request to a rendezvous server creates a pagination cookie, which the server kept in a map together with the registrations already returned for it. Entries were never evicted or capped, so an unauthenticated peer sending ordinary DISCOVER requests can make the server's memory grow without bound.\n\nThe fix keeps cookies in a fixed-size LRU cache (10,000 entries by default, configurable through `Config`). It is in 0.17.1.","affected":[{"package":{"name":"libp2p-rendezvous","ecosystem":"crates.io","purl":"pkg:cargo/libp2p-rendezvous"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.17.1"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["denial-of-service"],"cvss":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0527.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/libp2p-rendezvous"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0527.html"},{"type":"WEB","url":"https://github.com/libp2p/rust-libp2p/commit/8fde2dc0fae8b433f97c6cdf9ee24f59d51a359c"}],"database_specific":{"license":"CC0-1.0"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"}]} |