ChangeIntel IT change radar

Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-89146

libp2p-rendezvous through 0.17.1 Denial of Service via Unbounded Registration TTL in Discovery Responses

CVSS 3.1 7.5 HIGHCVSS 4.0 8.7 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.

cve-program · CVE-2026-89146

Published

libp2p-rendezvous through 0.17.1 fails to validate registration TTL values in discovery responses, allowing attackers to trigger timer arithmetic overflow. A malicious rendezvous server can send a discovery response with an unbounded TTL value that causes the client node process to panic when computing the expiry timer.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-89146

Published

libp2p-rendezvous

https://crates.io

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "vendor": "libp2p",
                    "product": "libp2p-rendezvous",
                    "packageName": "libp2p-rendezvous",
                    "packageURL": "pkg:cargo/libp2p-rendezvous",
                    "collectionURL": "https://crates.io",
                    "repo": "https://github.com/libp2p/rust-libp2p",
                    "versions": [
                        {
                            "version": "0",
                            "lessThanOrEqual": "0.17.1",
                            "status": "affected",
                            "versionType": "semver"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON