crates.ioPackage

libp2p-rendezvous

2 known vulnerabilities (2 high), with the versions each affects and the releases that fix them.

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-35457High 8.2
libp2p-rust has unbounded rendezvous DISCOVER cookies enable remote memory exhaustion
Affected: fixed in 0.17.1.
Fixed in 0.17.1 (released Apr 2, 2026, 5 days before disclosure).
The latest release, 0.18.0, is not affected.
53% of libp2p-rendezvous downloads in the last 90 days were affected versions (120.9K).
CVE-2026-35405High 7.5
libp2p-rendezvous: Unlimited namespace registrations per peer enables OOM DoS on rendezvous servers
Affected: fixed in 0.17.1.
Fixed in 0.17.1 (released Apr 2, 2026, 5 days before disclosure).
The latest release, 0.18.0, is not affected.
53% of libp2p-rendezvous downloads in the last 90 days were affected versions (120.9K).