negentropy

Version	Released
`0.4.4` patch	Oct 15, 2026
`0.5.2` patch	Oct 15, 2026
`0.5.1` patch 1 CVE	Aug 16, 2026
`0.5.0` unknown 1 CVE	Jan 31, 2025
`0.4.3` unknown 1 CVE	Sep 13, 2024
`0.4.2` unknown yanked 1 CVE	Sep 13, 2024
`0.4.1` unknown yanked 1 CVE	Sep 13, 2024
`0.4.0` unknown yanked 1 CVE	Dec 14, 2023
`0.3.1` unknown 1 CVE	Oct 03, 2023
`0.3.0` unknown 1 CVE	Sep 17, 2023
`0.2.1` unknown 1 CVE	Sep 13, 2023
`0.2.0` unknown 1 CVE	Sep 12, 2023
`0.1.0` unknown yanked	Sep 11, 2023
`0.0.0` unknown yanked	Sep 09, 2023

0.4.4 patch

Oct 15, 2026

0.5.2 patch

Oct 15, 2026

0.5.1 patch

1 CVE

RUSTSEC-2026-0365 Oct 14, 2026

Remote DoS through unchecked `IdList` allocation in negentropy

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The negentropy crate is vulnerable to denial-of-service through an unchecked, peer-controlled ID count in reconciliation messages.

With the std feature enabled, which is the default configuration, a small malformed message can trigger an enormous memory allocation and terminate the application.

Details

When processing an IdList range, the reconciliation parser uses the peer-provided ID count to reserve memory before checking whether the message contains the corresponding IDs:

let mut their_elems: HashSet<Id> =
    HashSet::with_capacity(num_ids as usize);

An attacker can declare an arbitrarily large count without supplying any IDs. The allocation occurs before the parser reaches the ID-reading loop, which would otherwise reject the truncated message.

With Rust's default allocation-error behavior, a failed allocation aborts the process rather than unwinding. Consequently, catch_unwind cannot contain the failure.

Both reconcile and reconcile_with_ids reach the vulnerable parser.

The patched versions validate the count against the remaining message length before allocating:

if num_ids > (query.len() / ID_SIZE) as u64 {
    return Err(Error::ParseEndsPrematurely);
}

Impact

An unauthenticated remote attacker can terminate an application that exposes reconciliation to untrusted peers without additional validation.

For example, a Nostr relay that forwards NEG-OPEN or NEG-MSG reconciliation payloads to the vulnerable parser can be taken down by a single client message. Clients processing messages from malicious relays are also exposed.

This specific vulnerability affects builds with the default std feature enabled. Builds without std use a BTreeSet and do not perform the vulnerable preallocation.

A message-size limit alone does not prevent exploitation because the malicious payload can be only a few bytes long.

Credit

Discovered and fixed by Alex Gleason (https://github.com/alexgleason).

Fixed in


          0.4.4


          0.5.2

References

Updated Oct 16, 2026 · Source: OSV.dev

Aug 16, 2026

0.5.0 unknown

1 CVE

RUSTSEC-2026-0365 Oct 14, 2026

Remote DoS through unchecked `IdList` allocation in negentropy

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The negentropy crate is vulnerable to denial-of-service through an unchecked, peer-controlled ID count in reconciliation messages.

With the std feature enabled, which is the default configuration, a small malformed message can trigger an enormous memory allocation and terminate the application.

Details

When processing an IdList range, the reconciliation parser uses the peer-provided ID count to reserve memory before checking whether the message contains the corresponding IDs:

let mut their_elems: HashSet<Id> =
    HashSet::with_capacity(num_ids as usize);

An attacker can declare an arbitrarily large count without supplying any IDs. The allocation occurs before the parser reaches the ID-reading loop, which would otherwise reject the truncated message.

With Rust's default allocation-error behavior, a failed allocation aborts the process rather than unwinding. Consequently, catch_unwind cannot contain the failure.

Both reconcile and reconcile_with_ids reach the vulnerable parser.

The patched versions validate the count against the remaining message length before allocating:

if num_ids > (query.len() / ID_SIZE) as u64 {
    return Err(Error::ParseEndsPrematurely);
}

Impact

An unauthenticated remote attacker can terminate an application that exposes reconciliation to untrusted peers without additional validation.

For example, a Nostr relay that forwards NEG-OPEN or NEG-MSG reconciliation payloads to the vulnerable parser can be taken down by a single client message. Clients processing messages from malicious relays are also exposed.

This specific vulnerability affects builds with the default std feature enabled. Builds without std use a BTreeSet and do not perform the vulnerable preallocation.

A message-size limit alone does not prevent exploitation because the malicious payload can be only a few bytes long.

Credit

Discovered and fixed by Alex Gleason (https://github.com/alexgleason).

Fixed in


          0.4.4


          0.5.2

References

Updated Oct 16, 2026 · Source: OSV.dev

Jan 31, 2025

0.4.3 unknown

1 CVE

RUSTSEC-2026-0365 Oct 14, 2026

Remote DoS through unchecked `IdList` allocation in negentropy

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The negentropy crate is vulnerable to denial-of-service through an unchecked, peer-controlled ID count in reconciliation messages.

With the std feature enabled, which is the default configuration, a small malformed message can trigger an enormous memory allocation and terminate the application.

Details

When processing an IdList range, the reconciliation parser uses the peer-provided ID count to reserve memory before checking whether the message contains the corresponding IDs:

let mut their_elems: HashSet<Id> =
    HashSet::with_capacity(num_ids as usize);

An attacker can declare an arbitrarily large count without supplying any IDs. The allocation occurs before the parser reaches the ID-reading loop, which would otherwise reject the truncated message.

With Rust's default allocation-error behavior, a failed allocation aborts the process rather than unwinding. Consequently, catch_unwind cannot contain the failure.

Both reconcile and reconcile_with_ids reach the vulnerable parser.

The patched versions validate the count against the remaining message length before allocating:

if num_ids > (query.len() / ID_SIZE) as u64 {
    return Err(Error::ParseEndsPrematurely);
}

Impact

An unauthenticated remote attacker can terminate an application that exposes reconciliation to untrusted peers without additional validation.

For example, a Nostr relay that forwards NEG-OPEN or NEG-MSG reconciliation payloads to the vulnerable parser can be taken down by a single client message. Clients processing messages from malicious relays are also exposed.

This specific vulnerability affects builds with the default std feature enabled. Builds without std use a BTreeSet and do not perform the vulnerable preallocation.

A message-size limit alone does not prevent exploitation because the malicious payload can be only a few bytes long.

Credit

Discovered and fixed by Alex Gleason (https://github.com/alexgleason).

Fixed in


          0.4.4


          0.5.2

References

Updated Oct 16, 2026 · Source: OSV.dev

Sep 13, 2024

0.4.2 unknown yanked

1 CVE

RUSTSEC-2026-0365 Oct 14, 2026

Remote DoS through unchecked `IdList` allocation in negentropy

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The negentropy crate is vulnerable to denial-of-service through an unchecked, peer-controlled ID count in reconciliation messages.

With the std feature enabled, which is the default configuration, a small malformed message can trigger an enormous memory allocation and terminate the application.

Details

When processing an IdList range, the reconciliation parser uses the peer-provided ID count to reserve memory before checking whether the message contains the corresponding IDs:

let mut their_elems: HashSet<Id> =
    HashSet::with_capacity(num_ids as usize);

An attacker can declare an arbitrarily large count without supplying any IDs. The allocation occurs before the parser reaches the ID-reading loop, which would otherwise reject the truncated message.

With Rust's default allocation-error behavior, a failed allocation aborts the process rather than unwinding. Consequently, catch_unwind cannot contain the failure.

Both reconcile and reconcile_with_ids reach the vulnerable parser.

The patched versions validate the count against the remaining message length before allocating:

if num_ids > (query.len() / ID_SIZE) as u64 {
    return Err(Error::ParseEndsPrematurely);
}

Impact

An unauthenticated remote attacker can terminate an application that exposes reconciliation to untrusted peers without additional validation.

For example, a Nostr relay that forwards NEG-OPEN or NEG-MSG reconciliation payloads to the vulnerable parser can be taken down by a single client message. Clients processing messages from malicious relays are also exposed.

This specific vulnerability affects builds with the default std feature enabled. Builds without std use a BTreeSet and do not perform the vulnerable preallocation.

A message-size limit alone does not prevent exploitation because the malicious payload can be only a few bytes long.

Credit

Discovered and fixed by Alex Gleason (https://github.com/alexgleason).

Fixed in


          0.4.4


          0.5.2

References

Updated Oct 16, 2026 · Source: OSV.dev

Sep 13, 2024

0.4.1 unknown yanked

1 CVE

RUSTSEC-2026-0365 Oct 14, 2026

Remote DoS through unchecked `IdList` allocation in negentropy

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The negentropy crate is vulnerable to denial-of-service through an unchecked, peer-controlled ID count in reconciliation messages.

With the std feature enabled, which is the default configuration, a small malformed message can trigger an enormous memory allocation and terminate the application.

Details

When processing an IdList range, the reconciliation parser uses the peer-provided ID count to reserve memory before checking whether the message contains the corresponding IDs:

let mut their_elems: HashSet<Id> =
    HashSet::with_capacity(num_ids as usize);

An attacker can declare an arbitrarily large count without supplying any IDs. The allocation occurs before the parser reaches the ID-reading loop, which would otherwise reject the truncated message.

With Rust's default allocation-error behavior, a failed allocation aborts the process rather than unwinding. Consequently, catch_unwind cannot contain the failure.

Both reconcile and reconcile_with_ids reach the vulnerable parser.

The patched versions validate the count against the remaining message length before allocating:

if num_ids > (query.len() / ID_SIZE) as u64 {
    return Err(Error::ParseEndsPrematurely);
}

Impact

An unauthenticated remote attacker can terminate an application that exposes reconciliation to untrusted peers without additional validation.

For example, a Nostr relay that forwards NEG-OPEN or NEG-MSG reconciliation payloads to the vulnerable parser can be taken down by a single client message. Clients processing messages from malicious relays are also exposed.

This specific vulnerability affects builds with the default std feature enabled. Builds without std use a BTreeSet and do not perform the vulnerable preallocation.

A message-size limit alone does not prevent exploitation because the malicious payload can be only a few bytes long.

Credit

Discovered and fixed by Alex Gleason (https://github.com/alexgleason).

Fixed in


          0.4.4


          0.5.2

References

Updated Oct 16, 2026 · Source: OSV.dev

Sep 13, 2024

0.4.0 unknown yanked

1 CVE

RUSTSEC-2026-0365 Oct 14, 2026

Remote DoS through unchecked `IdList` allocation in negentropy

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The negentropy crate is vulnerable to denial-of-service through an unchecked, peer-controlled ID count in reconciliation messages.

With the std feature enabled, which is the default configuration, a small malformed message can trigger an enormous memory allocation and terminate the application.

Details

When processing an IdList range, the reconciliation parser uses the peer-provided ID count to reserve memory before checking whether the message contains the corresponding IDs:

let mut their_elems: HashSet<Id> =
    HashSet::with_capacity(num_ids as usize);

An attacker can declare an arbitrarily large count without supplying any IDs. The allocation occurs before the parser reaches the ID-reading loop, which would otherwise reject the truncated message.

With Rust's default allocation-error behavior, a failed allocation aborts the process rather than unwinding. Consequently, catch_unwind cannot contain the failure.

Both reconcile and reconcile_with_ids reach the vulnerable parser.

The patched versions validate the count against the remaining message length before allocating:

if num_ids > (query.len() / ID_SIZE) as u64 {
    return Err(Error::ParseEndsPrematurely);
}

Impact

An unauthenticated remote attacker can terminate an application that exposes reconciliation to untrusted peers without additional validation.

For example, a Nostr relay that forwards NEG-OPEN or NEG-MSG reconciliation payloads to the vulnerable parser can be taken down by a single client message. Clients processing messages from malicious relays are also exposed.

This specific vulnerability affects builds with the default std feature enabled. Builds without std use a BTreeSet and do not perform the vulnerable preallocation.

A message-size limit alone does not prevent exploitation because the malicious payload can be only a few bytes long.

Credit

Discovered and fixed by Alex Gleason (https://github.com/alexgleason).

Fixed in


          0.4.4


          0.5.2

References

Updated Oct 16, 2026 · Source: OSV.dev

Dec 14, 2023

0.3.1 unknown

1 CVE

RUSTSEC-2026-0365 Oct 14, 2026

Remote DoS through unchecked `IdList` allocation in negentropy

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The negentropy crate is vulnerable to denial-of-service through an unchecked, peer-controlled ID count in reconciliation messages.

With the std feature enabled, which is the default configuration, a small malformed message can trigger an enormous memory allocation and terminate the application.

Details

When processing an IdList range, the reconciliation parser uses the peer-provided ID count to reserve memory before checking whether the message contains the corresponding IDs:

let mut their_elems: HashSet<Id> =
    HashSet::with_capacity(num_ids as usize);

An attacker can declare an arbitrarily large count without supplying any IDs. The allocation occurs before the parser reaches the ID-reading loop, which would otherwise reject the truncated message.

With Rust's default allocation-error behavior, a failed allocation aborts the process rather than unwinding. Consequently, catch_unwind cannot contain the failure.

Both reconcile and reconcile_with_ids reach the vulnerable parser.

The patched versions validate the count against the remaining message length before allocating:

if num_ids > (query.len() / ID_SIZE) as u64 {
    return Err(Error::ParseEndsPrematurely);
}

Impact

An unauthenticated remote attacker can terminate an application that exposes reconciliation to untrusted peers without additional validation.

For example, a Nostr relay that forwards NEG-OPEN or NEG-MSG reconciliation payloads to the vulnerable parser can be taken down by a single client message. Clients processing messages from malicious relays are also exposed.

This specific vulnerability affects builds with the default std feature enabled. Builds without std use a BTreeSet and do not perform the vulnerable preallocation.

A message-size limit alone does not prevent exploitation because the malicious payload can be only a few bytes long.

Credit

Discovered and fixed by Alex Gleason (https://github.com/alexgleason).

Fixed in


          0.4.4


          0.5.2

References

Updated Oct 16, 2026 · Source: OSV.dev

Oct 03, 2023

0.3.0 unknown

1 CVE

RUSTSEC-2026-0365 Oct 14, 2026

Remote DoS through unchecked `IdList` allocation in negentropy

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The negentropy crate is vulnerable to denial-of-service through an unchecked, peer-controlled ID count in reconciliation messages.

With the std feature enabled, which is the default configuration, a small malformed message can trigger an enormous memory allocation and terminate the application.

Details

When processing an IdList range, the reconciliation parser uses the peer-provided ID count to reserve memory before checking whether the message contains the corresponding IDs:

let mut their_elems: HashSet<Id> =
    HashSet::with_capacity(num_ids as usize);

An attacker can declare an arbitrarily large count without supplying any IDs. The allocation occurs before the parser reaches the ID-reading loop, which would otherwise reject the truncated message.

With Rust's default allocation-error behavior, a failed allocation aborts the process rather than unwinding. Consequently, catch_unwind cannot contain the failure.

Both reconcile and reconcile_with_ids reach the vulnerable parser.

The patched versions validate the count against the remaining message length before allocating:

if num_ids > (query.len() / ID_SIZE) as u64 {
    return Err(Error::ParseEndsPrematurely);
}

Impact

An unauthenticated remote attacker can terminate an application that exposes reconciliation to untrusted peers without additional validation.

For example, a Nostr relay that forwards NEG-OPEN or NEG-MSG reconciliation payloads to the vulnerable parser can be taken down by a single client message. Clients processing messages from malicious relays are also exposed.

This specific vulnerability affects builds with the default std feature enabled. Builds without std use a BTreeSet and do not perform the vulnerable preallocation.

A message-size limit alone does not prevent exploitation because the malicious payload can be only a few bytes long.

Credit

Discovered and fixed by Alex Gleason (https://github.com/alexgleason).

Fixed in


          0.4.4


          0.5.2

References

Updated Oct 16, 2026 · Source: OSV.dev

Sep 17, 2023

0.2.1 unknown

1 CVE

RUSTSEC-2026-0365 Oct 14, 2026

Remote DoS through unchecked `IdList` allocation in negentropy

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The negentropy crate is vulnerable to denial-of-service through an unchecked, peer-controlled ID count in reconciliation messages.

With the std feature enabled, which is the default configuration, a small malformed message can trigger an enormous memory allocation and terminate the application.

Details

When processing an IdList range, the reconciliation parser uses the peer-provided ID count to reserve memory before checking whether the message contains the corresponding IDs:

let mut their_elems: HashSet<Id> =
    HashSet::with_capacity(num_ids as usize);

An attacker can declare an arbitrarily large count without supplying any IDs. The allocation occurs before the parser reaches the ID-reading loop, which would otherwise reject the truncated message.

With Rust's default allocation-error behavior, a failed allocation aborts the process rather than unwinding. Consequently, catch_unwind cannot contain the failure.

Both reconcile and reconcile_with_ids reach the vulnerable parser.

The patched versions validate the count against the remaining message length before allocating:

if num_ids > (query.len() / ID_SIZE) as u64 {
    return Err(Error::ParseEndsPrematurely);
}

Impact

An unauthenticated remote attacker can terminate an application that exposes reconciliation to untrusted peers without additional validation.

For example, a Nostr relay that forwards NEG-OPEN or NEG-MSG reconciliation payloads to the vulnerable parser can be taken down by a single client message. Clients processing messages from malicious relays are also exposed.

This specific vulnerability affects builds with the default std feature enabled. Builds without std use a BTreeSet and do not perform the vulnerable preallocation.

A message-size limit alone does not prevent exploitation because the malicious payload can be only a few bytes long.

Credit

Discovered and fixed by Alex Gleason (https://github.com/alexgleason).

Fixed in


          0.4.4


          0.5.2

References

Updated Oct 16, 2026 · Source: OSV.dev

Sep 13, 2023

0.2.0 unknown

1 CVE

RUSTSEC-2026-0365 Oct 14, 2026

Remote DoS through unchecked `IdList` allocation in negentropy

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The negentropy crate is vulnerable to denial-of-service through an unchecked, peer-controlled ID count in reconciliation messages.

With the std feature enabled, which is the default configuration, a small malformed message can trigger an enormous memory allocation and terminate the application.

Details

When processing an IdList range, the reconciliation parser uses the peer-provided ID count to reserve memory before checking whether the message contains the corresponding IDs:

let mut their_elems: HashSet<Id> =
    HashSet::with_capacity(num_ids as usize);

An attacker can declare an arbitrarily large count without supplying any IDs. The allocation occurs before the parser reaches the ID-reading loop, which would otherwise reject the truncated message.

With Rust's default allocation-error behavior, a failed allocation aborts the process rather than unwinding. Consequently, catch_unwind cannot contain the failure.

Both reconcile and reconcile_with_ids reach the vulnerable parser.

The patched versions validate the count against the remaining message length before allocating:

if num_ids > (query.len() / ID_SIZE) as u64 {
    return Err(Error::ParseEndsPrematurely);
}

Impact

An unauthenticated remote attacker can terminate an application that exposes reconciliation to untrusted peers without additional validation.

For example, a Nostr relay that forwards NEG-OPEN or NEG-MSG reconciliation payloads to the vulnerable parser can be taken down by a single client message. Clients processing messages from malicious relays are also exposed.

This specific vulnerability affects builds with the default std feature enabled. Builds without std use a BTreeSet and do not perform the vulnerable preallocation.

A message-size limit alone does not prevent exploitation because the malicious payload can be only a few bytes long.

Credit

Discovered and fixed by Alex Gleason (https://github.com/alexgleason).

Fixed in


          0.4.4


          0.5.2

References

Updated Oct 16, 2026 · Source: OSV.dev

Sep 12, 2023

0.1.0 unknown yanked

Sep 11, 2023

0.0.0 unknown yanked

Sep 09, 2023

Activity

Reach

Details