CVE-2026-35405

OVERVIEW CVE-2026-35405 is a denial-of-service vulnerability affecting libp2p-rust versions prior to 0.17.1, specifically impacting the libp2p-rendezvous server component. The vulnerability exists because the rendezvous server fails to implement limits on the number of unique namespaces that a single peer can register, allowing attackers to exhaust server memory through unbounded registration operations. SEVERITY This vulnerability carries a CVSS score of 7.5 (HIGH) with a network-based attack vector requiring no authentication or user interaction. The attack has low complexity and directly impacts availability by causing out-of-memory conditions that can terminate the server process. An attacker or coordinated group of malicious peers can trigger denial-of-service by repeatedly registering unique namespaces in a loop, with minimal effort required to launch the attack at scale. EXPLOITATION STATUS There is no evidence of active exploitation in the wild, as the vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog and appears inactive on threat tracking lists. The EPSS score of 0.00052 indicates minimal likelihood of exploitation, suggesting limited community awareness or interest. Remediation is straightforward through upgrading to libp2p-rust version 0.17.1 or later, which implements proper namespace registration limits.