High severity8.2NVD Advisory· Published Apr 7, 2026· Updated Apr 24, 2026

CVE-2026-35457

Description

libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, the rendezvous server stores pagination cookies without bounds. An unauthenticated peer can repeatedly issue DISCOVER requests and force unbounded memory growth. This vulnerability is fixed in 0.17.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
libp2p-rendezvouscrates.io	< 0.17.1	0.17.1

Affected products

Ipld/Libp2p
cpe:2.3:a:protocol:libp2p:*:*:*:*:*:rust:*:*
Range: <0.17.1
ghsa-coords
pkg:cargo/libp2p-rendezvous
Range: < 0.17.1

Patches

Vulnerability mechanics

References

github.com/libp2p/rust-libp2p/security/advisories/GHSA-v5hw-cv9c-rpg7nvdExploitVendor AdvisoryWEB
github.com/advisories/GHSA-v5hw-cv9c-rpg7ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-35457ghsaADVISORY

News mentions

No linked articles in our index yet.

cvss	0.533
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000