CVE-2026-89146 libp2p CVE debrief

Who should care

Defenders responsible for libp2p-rendezvous deployments should assess exposure and prioritize verification of the version in use. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify the version of libp2p-rendezvous in use and assess exposure to untrusted rendezvous servers.

Why it matters

Defenders should prioritize verifying the version of libp2p-rendezvous in use and assessing exposure to untrusted rendezvous servers due to the potential for denial of service via timer arithmetic overflow.

• Denial of service via panic in client node process
• Potential for timer arithmetic overflow
• Need for verification of libp2p-rendezvous version in use

Technical summary

libp2p-rendezvous through 0.17.1 fails to validate registration TTL values in discovery responses, allowing attackers to trigger timer arithmetic overflow. A malicious rendezvous server can send a discovery response with an unbounded TTL value that causes the client node process to panic when computing the expiry timer. This vulnerability affects defenders responsible for libp2p-rendezvous deployments, who should assess exposure and prioritize verification of the version in use. The vulnerability has a high CVSS score of 8.7 and is considered a denial-of-service (DoS) vulnerability.

Defensive priority

Defenders should prioritize verifying the version of libp2p-rendezvous in use and assessing exposure to untrusted rendezvous servers.

Recommended defensive actions

• Verify the version of libp2p-rendezvous in use and assess exposure to untrusted rendezvous servers
• Consider upgrading to a version of libp2p-rendezvous that validates registration TTL values
• Monitor for suspicious activity from untrusted rendezvous servers
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description and CVSS score. The vulnerability is caused by a failure to validate registration TTL values in discovery responses, which allows attackers to trigger timer arithmetic overflow. The CVE record was published on 2026-09-11T11:16:57.867Z and has not been modified since then. The NVD entry provides additional information on the vulnerability, including its CVSS score and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.