A vulnerability in the rust-libp2p networking stack allows unauthenticated remote attackers to cause a denial of service via memory exhaustion.

This flaw involves an improper allocation of resources without limits (CWE-770) within the libp2p-rendezvous server component. An unauthenticated attacker can register an unlimited number of unique namespaces, leading to excessive memory consumption and an eventual process crash.

The exploitation of this vulnerability results in a denial of service, rendering the libp2p-rendezvous server unavailable to legitimate peers. Given a CVSS score of 7.5, this high severity issue poses a significant risk to network availability and service reliability for any infrastructure relying on this library.

Immediate Action: Update the rust-libp2p dependency to version 0.17.1 or later to implement necessary resource constraints.

Proactive Monitoring: Monitor server memory usage metrics for sudden, sustained spikes that could indicate an ongoing resource exhaustion attack.

Compensating Controls: Implement rate limiting at the network or application layer to restrict the frequency of registration requests from individual peers.

Public Exploit Available: Unknown

The risk of service disruption is high for deployments using the affected rendezvous server component. Organizations should prioritize updating to version 0.17.1 immediately to introduce the required throttling mechanisms and prevent memory exhaustion attacks.