libp2p-rendezvous CVE-2026-89146

The victim client must initiate a peer discovery request against a rendezvous server controlled or compromised by the attacker; the vulnerability fires on the inbound discovery response. Clients connecting exclusively to self-operated, trusted rendezvous servers are not reachable by an external attacker. No authentication, special platform configuration, or specific OS is required beyond normal libp2p-rendezvous client usage (version ≤0.17.1). The limiting factor is server-position: the attacker must occupy or impersonate the rendezvous server role in the discovery exchange - a passive network observer cannot trigger this remotely.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) scores 8.7 and suggests a low-complexity, unauthenticated network exploit - but the practical attack surface is narrower than that score implies. Exploitation unconditionally requires the attacker to control or impersonate a rendezvous server that the target client connects to; an arbitrary internet attacker who has no position in the discovery path cannot trigger this remotely. The scope is therefore limited to deployments using public or untrusted rendezvous servers, or deployments where a rendezvous server has been compromised. The availability impact is complete (process panic/crash), with no confidentiality or integrity impact. EPSS data is not included in the available inputs; even a mid-sized operator in zabrze running libp2p-based infrastructure on public rendezvous endpoints should treat this as a patch-or-migrate priority given the trivial exploit complexity once server-position is achieved. No CISA KEV listing is present. A public proof-of-concept gist exists, lowering the barrier for any attacker who already controls a rendezvous server.

An attacker operates or compromises a libp2p rendezvous server reachable by target nodes. When a victim client performs a peer discovery request, the attacker returns a crafted discovery response containing a TTL value near or at the maximum integer boundary. The client's timer computation in src/client.rs overflows, the Rust runtime detects the invalid arithmetic, and the client process panics and terminates - achieving an unauthenticated denial-of-service against any node using that rendezvous server. A public proof-of-concept gist is referenced in the CVE.