CVE-2026-89146

libp2p-rendezvous through 0.17.1 does not validate the registration TTL values contained in discovery responses, which allows a timer arithmetic overflow (CWE-190) when the client computes the expiry timer. A malicious or compromised rendezvous server can return an unbounded TTL value, causing the client node process to panic (CWE-617), an unauthenticated remote denial of service with high availability impact (CVSS 4.0: 8.7). Only operators running software that uses the Rust libp2p rendezvous implementation and connects to rendezvous servers are affected. There is no public proof-of-concept, no evidence of in-the-wild exploitation, and the issue is not in the CISA KEV catalog.

What to do: Upgrade libp2p-rendezvous to a fixed release once published (no fixed version is provided in the current disclosure data) and monitor rust-libp2p release notes. Until patched, connect only to trusted rendezvous servers, clamp or sanity-check TTL values received in discovery responses where the code allows, and run node processes under a supervisor (auto-restart/watchdog) to limit downtime from panics.