The vulnerability lies in the libp2p‑rendezvous server’s lack of enforcement on namespace registrations. A malicious peer can repeatedly register unique namespaces, each registration allocating memory on the server without any limits. This unbounded growth can consume all available memory, ultimately leading to an out‑of‑process termination of the server. The core weakness is an uncontrolled resource consumption error, identified as CWE‑770. The impact manifests as service disruption, denying legitimate peers from utilizing the rendezvous service.

The affected component is the libp2p‑rendezvous server implemented in the Rust libp2p networking stack. Versions prior to 0.17.1 are susceptible. Any system running the server in this version range is at risk.

The CVSS score of 7.5 indicates a high severity for this resource exhaustion flaw. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited publicly known exploitation. Based on the description, the likely attack vector is a remote peer connecting to the rendezvous server and issuing namespace registration requests, which the server accepts unconditionally, allowing a distributed or single adversary to trigger service failure.