{"id":"CVE-2026-89146","title":"libp2p-rendezvous through 0.17.1 fails to validate registration TTL values in discovery responses, allowing attackers to trigger timer arithmetic overflow","summary":"libp2p-rendezvous through 0.17.1 fails to validate registration TTL values in discovery responses, allowing attackers to trigger timer arithmetic overflow. A malicious rendezvous server can send a discovery response with an unbounded TTL…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-190","CWE-617"],"vendor":"libp2p","product":"libp2p-rendezvous","affected":["libp2p-rendezvous <= 0.17.1"],"published":"2026-09-11","updated":"2026-09-23","sourceUpdated":"2026-09-23T17:17:43.997","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89146","references":[{"url":"https://docs.rs/crate/libp2p-rendezvous/0.17.1/source/src/client.rs","label":"disclosure@vulncheck.com"},{"url":"https://gist.github.com/thesmartshadow/25ef03f7ebbd12118a9d27695c885989","label":"disclosure@vulncheck.com"},{"url":"https://github.com/libp2p/rust-libp2p","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/libp2p-rendezvous-through-0.17.1-denial-of-service-via-unbounded-registration-ttl-in-discovery-responses","label":"disclosure@vulncheck.com"},{"url":"https://gist.github.com/thesmartshadow/25ef03f7ebbd12118a9d27695c885989","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","exploit-available"],"epss":0.00425,"epssPercentile":0.36447,"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-11T18:56:08.559551Z"},"ingestedAt":"2026-09-14T13:33:47.163Z","slug":"CVE-2026-89146","body":"## Overview\n\nlibp2p-rendezvous through 0.17.1 fails to validate registration TTL values in discovery responses, allowing attackers to trigger timer arithmetic overflow. A malicious rendezvous server can send a discovery response with an unbounded TTL value that causes the client node process to panic when computing the expiry timer.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":95606,"id":"CVE-2026-89146","ts":1789156664392,"field":"exploit_available","old":"false","new":"true"}]}