The vulnerability CVE-2026-35457 affects rust-libp2p versions before 0.17.1. It involves CWE-770: Allocation of Resources Without Limits or Throttling. Specifically, the rendezvous server stores pagination cookies indefinitely without bounds. An unauthenticated attacker can exploit this by repeatedly issuing DISCOVER requests, causing unbounded memory consumption and potentially leading to denial of service. The vulnerability is addressed by limiting or bounding the storage of these pagination cookies in rust-libp2p version 0.17.1.

An unauthenticated attacker can cause unbounded memory growth on the rendezvous server by repeatedly sending DISCOVER requests, leading to denial of service conditions. There is no direct confidentiality impact, but integrity is impacted due to potential service disruption. The CVSS score of 8.2 reflects high severity with network attack vector, no privileges required, no user interaction, and high impact on availability.

This vulnerability is fixed in rust-libp2p version 0.17.1. Users should upgrade to version 0.17.1 or later to remediate this issue. Patch status is not explicitly stated in vendor advisories but the description confirms the fix is included in 0.17.1. Until upgraded, consider limiting exposure of the rendezvous server to untrusted networks or implementing external rate limiting to mitigate unbounded resource consumption.