Description
libp2p-rendezvous through 0.17.1 fails to validate registration TTL values in discovery responses, allowing attackers to trigger timer arithmetic overflow. A malicious rendezvous server can send a discovery response with an unbounded TTL value that causes the client node process to panic when computing the expiry timer.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| libp2p | libp2p-rendezvous | ≤ 0.17.1 | — |
References
- libp2p-rendezvous registration lifetime denial of service third-party-advisory
- src/client.rs at libp2p-rendezvous 0.17.1 technical-description
- Product product
- VulnCheck Advisory: libp2p-rendezvous through 0.17.1 Denial of Service via Unbounded Registration TTL in Discovery Responses third-party-advisory