- Reported
-
- Issued
-
- Package
-
libp2p-rendezvous
(crates.io)
- Type
-
Vulnerability
- Categories
-
- Keywords
-
#libp2p
#rendezvous
#memory-exhaustion
- Aliases
-
- References
-
- CVSS Score
- 7.5
HIGH
- CVSS Details
-
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- Scope
- Unchanged
- Confidentiality Impact
- None
- Integrity Impact
- None
- Availability Impact
- High
- CVSS Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Patched
-
Description
The rendezvous server's registration store did not limit how many namespaces a single peer could register, or how many registrations it held in total. Each registration stays until its TTL expires, up to 72 hours, and is not removed when the peer disconnects. An unauthenticated peer can send REGISTER requests for new namespaces in a loop, and many peers together can exhaust the server's memory, cutting off discovery for every client that relies on it.
The fix adds limits on registrations per peer (32 by default) and in total (10,000 by default), configurable through Config, and answers requests over the limit with an Unavailable error. It is in 0.17.1.
Advisory available under CC0-1.0
license.