CVE-2026-35457: libp2p rust-libp2p
CVSS: 8.2v3.1HighAnalyzed
AliasesGHSA-v5hw-cv9c-rpg7
Published 07-04-2026Last modified 07-04-2026
Vulnerability summary
CVE-2026-35457 is a high (CVSS 8.2) vulnerability in libp2p rust-libp2p. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 35.3% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
8.2/10
010
High · v3.1 (CVE.org)EPSS score
0.42%
0%100%
Low · +0.14 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Timeline
- 07-04-2026PublishedVulnerability first disclosed.
- 07-04-2026Last modifiedVulnerability information updated.
Description
libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, the rendezvous server stores pagination cookies without bounds. An unauthenticated peer can repeatedly issue DISCOVER requests and force unbounded memory growth. This vulnerability is fixed in 0.17.1.
CVSS metrics
3 scores · 3 sources · 1 versionHigh 8.2Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:HSourcesAll 3 agree
- OSV · Crates.ioEcosystem advisory · calculated8.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
- NVDNIST8.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
EPSS trend
Probability
0.42%
Chance of exploitation in the next 30 days
Percentile
35%
Versus all other CVEs
30-day change
+0.14 pp
From 0.29% on 20-09-2026
20-09-202620-10-2026
EPSS score0.42%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundRust Libp2P
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Crates.Io1 product
- libp2p-rendezvous< 0.17.1
Libp2p1 product
- rust-libp2p< 0.17.1
Protocol1 product
- libp2p< 0.17.1
3 vendors · 3 products
References
3 links- github.com/libp2p/rust-libp2p/security/advisories/GHSA-v5hw-cv9c-rpg7X Refsource CONFIRMWEBExploitVendor Advisory
