Remote DoS through unchecked `IdList` allocation in negentropy

## Summary The `negentropy` crate is vulnerable to denial-of-service through an unchecked, peer-controlled ID count in reconciliation messages. With the `std` feature enabled, which is the default configuration, a small malformed message can trigger an enormous memory allocation and terminate the application. ## Details When processing an `IdList` range, the reconciliation parser uses the peer-provided ID count to reserve memory before checking whether the message contains the corresponding IDs: ```rust let mut their_elems: HashSet<Id> = HashSet::with_capacity(num_ids as usize); ``` An attacker can declare an arbitrarily large count without supplying any IDs. The allocation occurs before the parser reaches the ID-reading loop, which would otherwise reject the truncated message. With Rust's default allocation-error behavior, a failed allocation aborts the process rather than unwinding. Consequently, `catch_unwind` cannot contain the failure. Both `reconcile` and `reconcile_with_ids` reach the vulnerable parser. The patched versions validate the count against the remaining message length before allocating: ```rust if num_ids > (query.len() / ID_SIZE) as u64 { return Err(Error::ParseEndsPrematurely); } ``` ## Impact An unauthenticated remote attacker can terminate an application that exposes reconciliation to untrusted peers without additional validation. For example, a Nostr relay that forwards `NEG-OPEN` or `NEG-MSG` reconciliation payloads to the vulnerable parser can be taken down by a single client message. Clients processing messages from malicious relays are also exposed. This specific vulnerability affects builds with the default `std` feature enabled. Builds without `std` use a `BTreeSet` and do not perform the vulnerable preallocation. A message-size limit alone does not prevent exploitation because the malicious payload can be only a few bytes long. ## Credit Discovered and fixed by **Alex Gleason** (<https://github.com/alexgleason>).

Source published

14 Oct 2026 12:00:00 UTC

Source modified

16 Oct 2026 23:30:02 UTC

Observed here

24 Oct 2026 13:19:54 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H