CVE Feed

    Dashboard / CVE / CVE-2026-89146

    CVE-2026-89146

    libp2p-rendezvous through 0.17.1 fails to validate registration TTL values in discovery responses, allowing attackers to trigger timer arithmetic overflow. A malicious rendezvous server can send a discovery response with an unbounded TTL value that causes the client node process to panic when computing the expiry timer.

    Published:Sep 11, 2026
    Last Modified:Sep 13, 2026
    EPS:Sep 11, 2026
    EPSS Score:0.00425
    CVSS Score:7.5

    Affected Products

    Vendor
    Libp2p
    Product
    Libp2p-rendezvous

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-92 Forced Integer Overflow

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High