Libp2P Rendezvous
Monthly
Denial-of-service in libp2p-rendezvous ≤0.17.1 (Rust) allows a malicious rendezvous server to crash any connecting client node by sending a discovery response containing an unbounded TTL value. The client fails to validate the TTL before computing an expiry timer, triggering a CWE-190 integer arithmetic overflow that causes a Rust process panic. A proof-of-concept gist has been published; no confirmed active exploitation has been identified at time of analysis.
Denial-of-service in libp2p-rendezvous ≤0.17.1 (Rust) allows a malicious rendezvous server to crash any connecting client node by sending a discovery response containing an unbounded TTL value. The client fails to validate the TTL before computing an expiry timer, triggering a CWE-190 integer arithmetic overflow that causes a Rust process panic. A proof-of-concept gist has been published; no confirmed active exploitation has been identified at time of analysis.