Vulnerability RUSTSEC-2026-0527
High Risk
HIGH RISK
CVSS Score: 8.2
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
7 months ago
April 02, 2026 at 12:00 PM UTC
Rendezvous server stored an unlimited number of DISCOVER cookies
>=0.0.0-0 <0.17.1
>=0.0.0-0 <0.17.1
Summary
Rendezvous server stored an unlimited number of DISCOVER cookies
Details
Each DISCOVER request to a rendezvous server creates a pagination cookie, which the server kept in a map together with the registrations already returned for it. Entries were never evicted or capped, so an unauthenticated peer sending ordinary DISCOVER requests can make the server's memory grow without bound.
The fix keeps cookies in a fixed-size LRU cache (10,000 entries by default, configurable through Config). It is in 0.17.1.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
7 months ago
libp2p-rendezvous: Unbounded rendezvous DISCOVER cookies enable remote memory exhaustion
<0.17.1 GHSA-v5hw-cv9c-rpg7
<0.17.1 GHSA-v5hw-cv9c-rpg7
High Risk
7 months ago
libp2p-rendezvous: Unlimited namespace registrations per peer enables OOM DoS on rendezvous servers
<0.17.1 GHSA-cqfx-gf56-8x59
<0.17.1 GHSA-cqfx-gf56-8x59
High Risk
7 months ago
Rendezvous server accepted unlimited registrations per peer
>=0.0.0-0 <0.17.1 RUSTSEC-2026-0526
>=0.0.0-0 <0.17.1 RUSTSEC-2026-0526
Impacted packages
Timeline
Published
7 months ago
April 02, 2026 at 12:00 PM UTC
Fixed (0.17.1)
7 months ago
April 02, 2026 at 07:42 PM UTC
Last Modified
3 hours ago
November 13, 2026 at 12:45 PM UTC