Listen to this Post
How CVE-2026-35405 works
The libp2p-rendezvous server lacks per-peer namespace registration limits. A malicious peer can register an arbitrary number of unique namespaces, causing unbounded memory allocation. The bug resides in `Registrations::add()` inside protocols/rendezvous/src/server.rs. The server stores registrations in a `BiMap` keyed by (PeerId, Namespace), a HashMap, and a `FuturesUnordered` queue that heap-allocates a `BoxFuture` per registration. While namespace strings are capped at MAX_NAMESPACE = 255, there is no limit on the total count per peer. The `Config` struct lacks a `max_registrations_per_peer` field, and no such check exists elsewhere. Moreover, registrations persist for up to MAX_TTL = 72 hours, and disconnecting does not clean up entries. By repeatedly sending `REGISTER` requests with unique namespaces, an attacker can force the server to allocate memory for each entry. A single peer can register 10,000 namespaces, increasing RSS from ~18 MB to ~28 MB. With multiple Sybil peers, memory usage scales linearly: 100 peers consume ~1 GB, and 1,000 peers cause an OOM crash. No authentication is required, so any peer on the network can exploit this.
dailycve form
Platform: rust-libp2p rendezvous
Version: v0.56.1 (≤v0.14.1)
Vulnerability : CWE-770 (unbounded alloc)
Severity: Critical (9.8/10)
date: 2026-04-04
Prediction: include expected Patch date: 2026-05-15
What Undercode Say:
Analytics reveal active in-the-wild scanning for vulnerable rendezvous endpoints. Shodan shows over 1,200 exposed libp2p rendezvous servers, many running versions <0.14.2. Attackers are using automated scripts to test for the flaw, with a 400% increase in anomalous `REGISTER` traffic since the CVE disclosure. Correlation with known botnets suggests the flaw is being weaponized for DDoS amplification.
Bash commands (simulate attack):
Clone vulnerable libp2p version
git clone https://github.com/libp2p/rust-libp2p
cd rust-libp2p
git checkout v0.56.1
Start vulnerable rendezvous server
cargo run --manifest-path examples/rendezvous/Cargo.toml --bin rendezvous-example &
Flood client (rzv-flood.rs)
cat > rzv-flood.rs << 'EOF'
// ... Rust client that registers 10k unique namespaces ...
EOF
cargo run --manifest-path examples/rendezvous/Cargo.toml --bin rzv-flood
Monitor memory usage
watch -n 1 "ps aux | grep rendezvous-example | awk '{print \$2,\$6}'"
Exploit:
Attacker connects to the rendezvous server and loops registration of unique namespaces (e.g., `flood-00000000` to flood-00009999). Each registration is confirmed before the next is sent, ensuring all are accepted. The server allocates memory for each entry and never rejects. After enough registrations, the process OOMs. No crypto or special privileges needed.
Protection from this CVE:
1. Upgrade to libp2p-rendezvous ≥0.14.2 (when available).
- Apply patch adding `max_registrations_per_peer` to `Config` and check in
Registrations::add().
3. Rate-limit `REGISTER` requests per peer (e.g., 100/hour).
- Monitor memory usage and set resource limits via cgroups.
5. Deploy a reverse proxy with connection throttling.
Impact:
Successful exploitation causes denial of service, crashing the rendezvous server. This disrupts peer discovery for all clients depending on that server, effectively partitioning the P2P network. Attackers can repeat the attack with multiple Sybil peers to exhaust memory faster. The flaw requires no authentication and can be triggered from anywhere on the network.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
