CVE-2026-89146
libp2p-rendezvous through 0.17.1 fails to validate registration TTL values in discovery responses, allowing attackers to trigger timer arith
CVSS
7.5
High
EPSS
—
KEV
—
Exploit Today
0
0-100
Published: Sep 11, 2026 · Last modified: Sep 11, 2026 · CWE-190 · CWE-617
Not enough EPSS history yet.
libp2p-rendezvous through 0.17.1 fails to validate registration TTL values in discovery responses, allowing attackers to trigger timer arithmetic overflow. A malicious rendezvous server can send a discovery response with an unbounded TTL value that causes the client node process to panic when computing the expiry timer.
- docs.rshttps://docs.rs/crate/libp2p-rendezvous/0.17.1/source/src/client.rs
- gist.github.comhttps://gist.github.com/thesmartshadow/25ef03f7ebbd12118a9d27695c885989
- github.comhttps://github.com/libp2p/rust-libp2p
- www.vulncheck.comhttps://www.vulncheck.com/advisories/libp2p-rendezvous-through-0.17.1-denial-of-service-via-unbounded-registration-ttl-in-discovery-responses
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-891586.5 MED—
——0PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.10hCVE-2026-891575.7 MED—
——0PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.10hCVE-2026-889144.4 MED—
——0A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can bypass a bounds check in the caption parser. This leads to an out-of-bounds heap read of up to 244 bytes, which is then included in the downstream caption output. An attacker could exploit this by tricking a user into opening a malicious media file, potentially resulting in disclosure of adjacent heap memory or application crash.12hCVE-2026-16174——
——0Netskope was notified about a potential gap in Netskope Endpoint DLP (EPDLP) running on Windows systems. Successful exploitation of the gap could potentially allow a privileged user to send a crafted message to the EPDLP process port to trigger an integer overflow, leading to memory corruption. Successful exploitation would require the EPDLP module to be enabled in the client configuration, and that Memory Integrity is disabled. A successful exploit could potentially result in a denial-of-service, arbitrary code execution, or privilege escalation on the local machine.15hCVE-2026-880354.7 MED—
——0A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause the application that embeds the driver to terminate unexpectedly. Reaching this code requires a build in which the optional external SASL authentication backend is present and a connection configured to use it.18hCVE-2026-852289.1 CRI—
——0An integer overflow in the tensor buffer validation component in Amazon Deep Java Library (DJL) from 0.13.0 through 0.36.0 on all platforms might allow a remote unauthenticated actor to obtain information from adjacent process memory or cause a denial of service via a crafted tensor payload.
To remediate this issue, users should upgrade to version 0.37.0 or above.18h