RUSTSEC-2026-0527

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0527

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0527.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0527

Aliases

CVE-2026-35457
GHSA-v5hw-cv9c-rpg7

Published

2026-04-02T12:00:00Z

Modified

2026-11-13T12:45:06Z

Severity

8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H CVSS Calculator

Summary

Rendezvous server stored an unlimited number of DISCOVER cookies

Details

Each DISCOVER request to a rendezvous server creates a pagination cookie, which the server kept in a map together with the registrations already returned for it. Entries were never evicted or capped, so an unauthenticated peer sending ordinary DISCOVER requests can make the server's memory grow without bound.

The fix keeps cookies in a fixed-size LRU cache (10,000 entries by default, configurable through Config). It is in 0.17.1.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / libp2p-rendezvous

Package

Name: libp2p-rendezvous; View open source insights on deps.dev
Purl: pkg:cargo/libp2p-rendezvous

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.17.1

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    }
}