CVE-2026-89146: libp2p-rendezvous through 0.17.1 Denial of Service via Unbounded Registration TTL in Discovery Responses
libp2p-rendezvous through 0.17.1 fails to validate registration TTL values in discovery responses, allowing attackers to trigger timer arithmetic overflow. A malicious rendezvous server can send a discovery response with an unbounded TTL value that causes the client node process to panic when computing the expiry timer.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this denial of service?
Client nodes using libp2p-rendezvous through version 0.17.1 are exposed when they process discovery responses from a malicious rendezvous server. The affected behavior is in the client-side expiry timer calculation.
What does an attacker need to do to trigger the issue?
An attacker needs to operate or control a rendezvous server that can send a discovery response to the client. The response must contain an unbounded registration TTL value that causes timer arithmetic to overflow.
Is authentication or user interaction required for exploitation?
No. The supplied vector indicates network exploitation with low attack complexity, no privileges required, and no user interaction required.
What is the observable impact of a successful attack?
The client node process panics while computing the registration expiry timer. This results in a denial of service affecting availability.