The negentropy crate is vulnerable to denial-of-service through an unchecked, peer-controlled ID count in reconciliation messages.

With the std feature enabled, which is the default configuration, a small malformed message can trigger an enormous memory allocation and terminate the application.

When processing an IdList range, the reconciliation parser uses the peer-provided ID count to reserve memory before checking whether the message contains the corresponding IDs:

let mut their elems: HashSet<Id> =
  HashSet::with capacity(num ids as usize);

An attacker can declare an arbitrarily large count without supplying any IDs. The allocation occurs before the parser reaches the ID-reading loop, which would otherwise reject the truncated message.

With Rust's default allocation-error behavior, a failed allocation aborts the process rather than unwinding. Consequently, catch unwind cannot contain the failure.

Both reconcile and reconcile with ids reach the vulnerable parser.

The patched versions validate the count against the remaining message length before allocating:

if num ids > (query.len() / ID SIZE) as u64 {
  return Err(Error::ParseEndsPrematurely);
}

An unauthenticated remote attacker can terminate an application that exposes reconciliation to untrusted peers without additional validation.

For example, a Nostr relay that forwards NEG-OPEN or NEG-MSG reconciliation payloads to the vulnerable parser can be taken down by a single client message. Clients processing messages from malicious relays are also exposed.

This specific vulnerability affects builds with the default std feature enabled. Builds without std use a BTreeSet and do not perform the vulnerable preallocation.

A message-size limit alone does not prevent exploitation because the malicious payload can be only a few bytes long.

Discovered and fixed by Alex Gleason (https://github.com/alexgleason).