Cpe:2.3:a:libp2p:libp2p-Rendezvous:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3alibp2plibp2p-rendezvous/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 11 Sep 2026 13:13:10 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgDenial of Service Vulnerability in libp2p-rendezvoushttps://feed.craftedsignal.io/briefs/2026-09-libp2p-dos/Fri, 11 Sep 2026 13:13:10 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-libp2p-dos/A vulnerability in libp2p-rendezvous through version 0.17.1 allows malicious rendezvous servers to crash client nodes by providing an unbounded registration TTL value.The libp2p-rendezvous library, in versions up to and including 0.17.1, contains a vulnerability involving the improper validation of Time-to-Live (TTL) values received in discovery responses. An attacker operating a malicious rendezvous server can send a specially crafted discovery response containing an arbitrarily large or malformed TTL value. When the client node receives this response and attempts to perform arithmetic operations for its internal expiry timers, the input triggers an integer overflow. This overflow causes the application process to panic and results in an immediate crash. As a result, the vulnerability acts as a remote denial-of-service vector against any libp2p node relying on the affected rendezvous library for peer discovery. Defenders should identify services utilizing libp2p-rendezvous and update to the patched version once available.

Impact

Successful exploitation results in the remote termination of the libp2p-rendezvous client process, leading to service disruption. This vulnerability impacts any system utilizing this library for P2P networking, potentially affecting decentralized applications, distributed data systems, or custom P2P-based network services.

Recommendation

Prioritize patching of all systems utilizing libp2p-rendezvous to a version beyond 0.17.1 as soon as an update is released by the maintainers. Monitor system logs for frequent process crashes or unexpected panics in applications leveraging this specific library. Conduct an inventory check of software dependencies to identify the inclusion of libp2p-rendezvous versions 0.17.1 or lower.

]]>lowadvisorydenial-of-servicevulnerabilitylibp2p