← Vulnerability feed

Vulnerability record · CVE-2026-35405 · published 7 April 2026

CVE-2026-35405: Protocol libp2p allocation without limits vulnerability

Protocol · Libp2p

libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, libp2p-rendezvous server has no limit on how many namespaces a single peer can register. A malicious peer can just keep registering unique namespaces in a loop and the server happily accepts every single one allocating memory for each registration with no pushback. Keep doing this long enough (or with multiple sybil peers) and the server process gets OOM killed. This vulnerability is fixed in 0.17.1.

7.5 CVSS 3.1 High EPSS 0.49% · top 60.6% CWE-770 · Allocation without limits
7.5CVSS 3.1 base score
0.49%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, libp2p-rendezvous server has no limit on how many namespaces a single peer can register. A malicious peer can just keep registering unique namespaces in a loop and the server happily accepts every single one allocating memory for each registration with no pushback. Keep doing this long enough (or with multiple sybil peers) and the server process gets OOM killed. This vulnerability is fixed in 0.17.1.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-cqfx-gf56-8x59 ExploitVendor Advisory
https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-cqfx-gf56-8x59 ExploitVendor Advisory

Track CVE-2026-35405 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.2CVE-2026-35457Protocol libp2p allocation without limits vulnerabilitylibp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, the rendezvous server stores pagination coo…EPSS 0.42%7.5CVE-2023-40583Protocol libp2p uncontrolled resource consumption vulnerabilitylibp2p is a networking stack and library modularized out of The IPFS Project, and bundled separately for other tools to use. In go-libp2p, by using s…EPSS 0.95%7.5CVE-2022-23492Protocol libp2p uncontrolled resource consumption vulnerabilitygo-libp2p is the offical libp2p implementation in the Go programming language. Version `0.18.0` and older of go-libp2p are vulnerable to targeted res…EPSS 1.0%7.5CVE-2022-23486Protocol libp2p uncontrolled resource consumption vulnerabilitylibp2p-rust is the official rust language Implementation of the libp2p networking stack. In versions prior to 0.45.1 an attacker node can cause a vic…EPSS 0.71%7.5CVE-2022-23487Protocol libp2p uncontrolled resource consumption vulnerabilityjs-libp2p is the official javascript Implementation of libp2p networking stack. Versions older than `v0.38.0` of js-libp2p are vulnerable to targeted…EPSS 0.71%8.6CVE-2020-3569Cisco IOS XR DVMRP IGMP packet handling memory exhaustionCisco IOS XR Software mishandles IGMP packets in its Distance Vector Multicast Routing Protocol (DVMRP) feature, allowing crafted traffic to crash th…KEVEPSS 3.3%analysed8.6CVE-2020-3566Cisco IOS XR DVMRP IGMP queue flaw causes memory exhaustionCisco IOS XR Software mishandles queue management for IGMP packets in its DVMRP feature, allowing uncontrolled memory consumption. An unauthenticated…KEVEPSS 3.7%analysed

Source: NIST National Vulnerability Database (record CVE-2026-35405), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.