Technical impact
libp2p-rendezvous 0.17.1 does not validate the time‑to‑live value that a rendezvous server sends in a discovery response. An attacker who can control a rendezvous server can set the TTL to an unbounded or excessively large value, causing the client to perform arithmetic that overflows the timer computation. The overflow results in a panic that crashes the client process, effectively denying service to the affected node.
Affected Systems
The vulnerability exists in the libp2p-rendezvous library distributed by the libp2p project. Version 0.17.1 and earlier are affected. No lower bound was listed, so any deployment that uses 0.17.1 or an earlier released version is at risk.
Risk and Exploitability
The CVSS score of 8.7 indicates a high‑severity impact. The EPSS score is not available, so the precise likelihood of exploitation is uncertain, but the lack of an official KEV listing suggests the vulnerability has not yet been widely exploited rendezvous server, which is a realistic scenario for an attacker who can compromise or impersonate a node in the network. Once the malicious server is reachable, the client will crash whenever it to disrupt the operation of the client node. Given the high severity and potential for service disruption, the vulnerability poses a significant risk to peer discovery in libp2p-rendezvous.
