Summary The Rust libp2p Gossipsub implementation accepts attacker-controlled PRUNE backoff values and may perform unchecked time arithmetic when storing backoff state. A specially crafted PRUNE control message with an extremely large backoff (e.g. u64::MAX) can lead to Duration/Instant overflow during backoff update logic, triggering a panic in the networking state machine. This is remotely reachable over a normal libp2p connection and does not require authentication.

Attack Scenario An attacker that can establish a libp2p Gossipsub session with a target node can crash the target by sending a single crafted PRUNE control message: 1. Establish a standard libp2p transport session and negotiate a stream multiplexer. 2. Open a Gossipsub stream and negotiate the meshsub protocol. 3. Send one protobuf RPC containing ControlPrune with a very large backoff value (e.g. 18446744073709551615 / u64::MAX). When processed, the oversized backoff can reach time-update logic that adds Duration::fromsecs(backoff) to Instant::now(), causing overflow and panic.

Impact Remote unauthenticated denial of service. Any application exposing a libp2p Gossipsub listener and using the affected backoff-handling path can be crashed by a network attacker that can reach the service port. The attack can be repeated by reconnecting and replaying the crafted control message. Patches Users should upgrade to a release that hardens Gossipsub backoff handling.

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Summary The rendezvous server stores pagination cookies without bounds. An unauthenticated peer can repeatedly issue DISCOVER requests and force unbounded memory growth.

Details

Pagination state is stored in:

rs HashMap<Cookie, HashSet<RegistrationId>>

On Message::Discover:

remote peer → DISCOVER → handlerequest → registrations.get(...) → new cookie generated → cookie inserted into Registrations::cookies

There is no upper bound or eviction policy, so repeated DISCOVER requests grow this map indefinitely.

PoC A reproduction test and minimal harness will be provided in a private fork in a follow-up comment.

Impact

Remote state amplification leading to memory exhaustion.

Properties:

- etwork reachable - no authentication required - low attack complexity - protocol-compliant traffic

Impacts rendezvous nodes exposed to untrusted peers. ---

Possible Fixes

1. Global cap + eviction

Bound cookie storage (MAXCOOKIESTRACKED) with FIFO/expiry aware eviction. Tradeoff: attacker can churn cookies and evict legitimate pagination state.

2. Stateless cookies

Encode pagination state in authenticated cookies instead of storing server-side state. Tradeoff: more complex implementation.

3. Rate limiting / per-peer quotas

Limit cookie creation per peer. Tradeoff: requires peer tracking.

Summary

Thelibp2p-rendezvous server has no limit on how many namespaces a single peer can register. A malicious peer can repeatedly register unique namespaces in a loop, and the server accepts the requests, allocating memory for each registration without pushback. If an attacker continues submitting malicous requests for long enough, (or with multiple sybil peers) the server process crashes due to OOM.

No auth is required; therefore, any peer on the network can do this.

Details

the bug is in Registrations::add() inside protocols/rendezvous/src/server.rs.

the store uses a BiMap keyed on (PeerId, Namespace) so yes, a peer can't register the same namespace twice. but there's nothing stopping it from registering 10,000 different namespaces. each unique one gets its own entry in:

- registrationsforpeer (BiMap) - registrations (HashMap) - nextexpiry (FuturesUnordered a new heap-allocated BoxFuture per registration)

namespace strings are only validated for length (MAXNAMESPACE = 255), not count. there's no maxregistrationsperpeer anywhere in Config or the rest of the codebase.

making it worse MAXTTL = 72 hours. so every registration just sits there for up to 3 days. disconnecting doesn't clean anything up either, entries only go away when the TTL fires.

protocols/rendezvous/src/server.rs └── Registrations::add() ← no per-peer count check anywhere

protocols/rendezvous/src/lib.rs ├── MAXNAMESPACE = 255 ← length capped, count is not └── MAXTTL = 72h ← entries persist a long time

fix would be adding something like maxregistrationsperpeer to Config and checking it at the top of add() before inserting anything.

PoC

tested on libp2p v0.56.1, built from source.

step 1 - start the rendezvous server (uses the example from the repo): bash cargo run --manifest-path examples/rendezvous/Cargo.toml --bin rendezvous-example

step 2 - run the flood client (attached as rzv-flood.rs): bash cargo run --manifest-path examples/rendezvous/Cargo.toml --bin rzv-flood

it connects as a single peer and registers 10,000 unique namespaces (flood-00000000 through flood-00009999), chaining each registration on the confirmed Registered event from the previous one.

server accepted every single one. not one rejection.

memory on the server side (via ps aux RSS column):

baseline: ~18 MB mid flood: ~26 MB after 10k regs: ~28 MB

that's from one peer. scale to 100 sybil peers doing the same thing and you're looking at ~1GB. 1000 peers and the server is dead.

<img width="1032" height="124" alt="image" src="https://github.com/user-attachments/assets/f778f179-2aa1-4485-940c-25e218733fa8" />

server RSS climbing during the flood

<img width="553" height="760" alt="image" src="https://github.com/user-attachments/assets/691b0f52-dda0-443f-a3c2-98c8c6336f2f" />

10,000 registrations confirmed, zero rejected

Impact

any node running libp2p-rendezvous server-side is affected. rendezvous servers are typically well-known, publicly reachable nodes taking one down disrupts peer discovery for all clients depending on it. any rust-libp2p based project that deploys a rendezvous point is at risk.

no special position on the network needed. no crypto work. just open a connection and send REGISTER in a loop.

libp2p-rust is the official rust language Implementation of the libp2p networking stack. In versions prior to 0.45.1 an attacker node can cause a victim node to allocate a large number of small memory chunks, which can ultimately lead to the victim’s process running out of memory and thus getting killed by its operating system. When executed continuously, this can lead to a denial of service attack, especially relevant on a larger scale when run against more than one node of a libp2p based network. Users are advised to upgrade to libp2p v0.45.1 or above. Users unable to upgrade should reference the DoS Mitigation page for more information on how to incorporate mitigation strategies, monitor their application, and respond to attacks: https://docs.libp2p.io/reference/dos-mitigation/.