---
id: RUSTSEC-2026-0365
title: ' Remote DoS through unchecked `IdList` allocation in negentropy'
summary: ' Remote DoS through unchecked `IdList` allocation in negentropy'
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
vendor: negentropy
product: negentropy
ecosystem: rust
affected:
  - 'negentropy >= 0.5.0, < 0.5.2'
patched:
  - negentropy 0.5.2
published: '2026-10-14'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T23:30:02.383532013Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0365'
references:
  - url: 'https://crates.io/crates/negentropy'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0365.html'
  - url: 'https://github.com/nostrdevkit/negentropy/pull/14'
  - url: >-
      https://github.com/nostrdevkit/negentropy/commit/40f7290cbc5755a5ba3190279fbc848a97866280
  - url: >-
      https://github.com/nostrdevkit/negentropy/commit/894a32c0ab9f3efd750b3cf06caee27b3f9c3f12
tags:
  - osv
  - rust
ingestedAt: '2026-10-17T11:50:15.358Z'
---

## Overview

## Summary

The `negentropy` crate is vulnerable to denial-of-service through an unchecked, peer-controlled ID count in reconciliation messages.

With the `std` feature enabled, which is the default configuration, a small malformed message can trigger an enormous memory allocation and terminate the application.

## Details

When processing an `IdList` range, the reconciliation parser uses the peer-provided ID count to reserve memory before checking whether the message contains the corresponding IDs:

```rust
let mut their_elems: HashSet<Id> =
    HashSet::with_capacity(num_ids as usize);
```

An attacker can declare an arbitrarily large count without supplying any IDs. The allocation occurs before the parser reaches the ID-reading loop, which would otherwise reject the truncated message.

With Rust's default allocation-error behavior, a failed allocation aborts the process rather than unwinding. Consequently, `catch_unwind` cannot contain the failure.

Both `reconcile` and `reconcile_with_ids` reach the vulnerable parser.

The patched versions validate the count against the remaining message length before allocating:

```rust
if num_ids > (query.len() / ID_SIZE) as u64 {
    return Err(Error::ParseEndsPrematurely);
}
```

## Impact

An unauthenticated remote attacker can terminate an application that exposes reconciliation to untrusted peers without additional validation.

For example, a Nostr relay that forwards `NEG-OPEN` or `NEG-MSG` reconciliation payloads to the vulnerable parser can be taken down by a single client message. Clients processing messages from malicious relays are also exposed.

This specific vulnerability affects builds with the default `std` feature enabled. Builds without `std` use a `BTreeSet` and do not perform the vulnerable preallocation.

A message-size limit alone does not prevent exploitation because the malicious payload can be only a few bytes long.

## Credit

Discovered and fixed by **Alex Gleason** (<https://github.com/alexgleason>).

## Affected packages

- `negentropy >= 0.5.0, < 0.5.2`

## Remediation

Upgrade to a patched release:

- `negentropy 0.5.2`