The rust-libp2p networking stack is vulnerable to denial of service attacks through unbounded memory allocation, which can be triggered by unauthenticated remote peers.

This vulnerability, categorized as CWE-770, occurs because the rendezvous server improperly handles pagination cookies by storing them without memory bounds. An unauthenticated remote attacker can exploit this by repeatedly sending DISCOVER requests, forcing the service to consume excessive memory and leading to a denial of service.

The ability for an unauthenticated attacker to remotely exhaust memory resources presents a significant threat to service availability. With a CVSS score of 8.2, this vulnerability is classified as High severity, as it allows for simple disruption of network services without requiring any prior authentication or user interaction.

Immediate Action: Update the rust-libp2p library to version 0.17.1 or later to implement the necessary bounds checking for pagination cookies.

Proactive Monitoring: Monitor server memory utilization and network traffic logs for an unusual spike in incoming DISCOVER requests from individual or multiple peers.

Compensating Controls: Implement rate limiting at the network or application layer to restrict the volume of requests a single peer can submit to the rendezvous service.

Public Exploit Available: Unknown

Given the ease of exploitation and the potential for complete service disruption, organizations utilizing rust-libp2p should prioritize updating to version 0.17.1 immediately. The lack of authentication requirements makes this an attractive target for automated denial of service attacks, necessitating swift remediation to maintain operational stability.