libp2p-rendezvous 0.17.1 does not validate the time‑to‑live value that a rendezvous server sends in a discovery response. An attacker who can control a rendezvous server can set the TTL to an unbounded or excessively large value, causing the client to perform arithmetic that overflows the timer computation. The overflow results in a panic that crashes the client process, effectively denying service to the affected node.

The vulnerability exists in the libp2p-rendezvous library distributed by the libp2p project. Version 0.17.1 and earlier are affected. No lower bound was listed, so any deployment that uses 0.17.1 or an earlier released version is at risk.

The CVSS score of 8.7 indicates a high‑severity impact. The EPSS score is not available, so the precise likelihood of exploitation is uncertain, but the lack of an official KEV listing suggests the vulnerability has not yet been widely exploited in the wild. The attack requires controlling a rendezvous server, which is a realistic scenario for an attacker who can compromise or impersonate a node in the network. Once the malicious server is reachable, the client will crash whenever it receives the unbounded TTL, allowing the attacker to disrupt the operation of the client node. Given the high severity and potential for service disruption, the vulnerability poses a significant risk to systems that rely on libp2p-rendezvous for peer discovery.