Description

libp2p-rendezvous through 0.17.1 fails to validate registration TTL values in discovery responses, allowing attackers to trigger timer arithmetic overflow. A malicious rendezvous server can send a discovery response with an unbounded TTL value that causes the client node process to panic when computing the expiry timer.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-11T11:16:57.867Z",
  "pubdate": "2026-09-11T11:16:57.867Z",
  "executiveSummary": "The libp2p-rendezvous library, specifically versions up to 0.17.1, contains an input validation vulnerability involving the processing of TTL (Time-To-Live) values in discovery responses. This flaw is categorized as an integer arithmetic vulnerability. By providing an unvalidated, malicious TTL value within a discovery response, a remote rendezvous server can force the client-side node to perform invalid timer arithmetic, resulting in an unhandled runtime panic.\nThe vulnerability allows a malicious rendezvous server to trigger a denial-of-service (DoS) condition on any connected libp2p-rendezvous client. As the client process terminates unexpectedly upon encountering the overflow, this attack effectively disrupts node participation in the peer-to-peer network. Exploitation is remote and requires no specific authentication, as the rendezvous client is designed to trust responses from the configured server. The impact is limited to service availability, with no documented potential for arbitrary code execution or unauthorized data access.",
  "technicalDetails": "The vulnerability resides in the logic responsible for parsing and scheduling registration expiry timers within libp2p-rendezvous. The library fails to perform proper bounds checking on the TTL field provided in discovery responses received from a rendezvous server. When the client receives a discovery packet, it attempts to translate the TTL into a duration used for internal timer management.\nThe root cause is an arithmetic overflow occurring during the calculation of the expiry timestamp. When an attacker-supplied TTL value exceeds the maximum allowable threshold for the underlying integer type used in the timer calculation, the arithmetic operation wraps around or results in a value that violates the safety invariants of the timer library. In Rust, such unchecked arithmetic or attempts to convert an invalid duration often trigger a thread panic.\nThe attack flow follows a predictable sequence: First, a malicious actor establishes or compromises a rendezvous server that the target client is configured to query. Second, the client initiates a discovery request to this server. Third, the malicious server returns a crafted discovery response containing an intentionally large, unbounded TTL value. Fourth, the client-side component processes this response and executes an arithmetic calculation (e.g., adding the TTL to the current system time). Finally, the arithmetic operation triggers an integer overflow or an invalid duration panic, causing the process to crash.\nThis vulnerability is particularly significant due to the nature of distributed systems; rendezvous discovery is a foundational mechanism for peer connectivity. By inducing a crash in the discovery layer, an attacker can prevent nodes from successfully discovering or connecting to the rest of the p2p network, effectively partitioning them. Because the rendezvous protocol involves implicit trust in the server's responses, client-side nodes lack internal verification mechanisms to reject non-sensical or out-of-bounds registration parameters. The vulnerability impacts all libp2p-rendezvous implementations through version 0.17.1. Exploitation is facilitated over the standard networking stack utilized by the library, meaning any network-reachable rendezvous server can serve as a vector if the client is configured to interact with it."
}