rustsec-2026-0231
Vulnerability from osv_rustsec
The SDK forwarded every NIP-42 AUTH challenge received from a relay through an
unbounded command queue. Challenge handling can wait for an asynchronous signer or
user interaction, so receiving challenges was substantially faster than completing
the corresponding authentication work.
A malicious relay could continuously send new challenges without authenticating or delivering valid events. Every value remained queued, causing memory use and pending signer operations to grow without a fixed limit until the client became unavailable. The issue does not allow the relay to forge a signature or learn the client's private key.
The SDK now coalesces pending challenges through a latest-value channel. NIP-42 makes an earlier challenge invalid when the relay sends a new one, so replacing pending work preserves the only challenge that can still be answered while keeping memory use bounded.
{
"affected": [
{
"database_specific": {
"categories": [
"denial-of-service"
],
"cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"informational": null
},
"ecosystem_specific": {
"affected_functions": null,
"affects": {
"arch": [],
"functions": [],
"os": []
}
},
"package": {
"ecosystem": "crates.io",
"name": "nostr-relay-pool",
"purl": "pkg:cargo/nostr-relay-pool"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.0-0"
},
{
"fixed": "0.44.3"
}
],
"type": "SEMVER"
}
],
"versions": []
}
],
"aliases": [],
"database_specific": {
"license": "CC0-1.0"
},
"details": "The SDK forwarded every NIP-42 `AUTH` challenge received from a relay through an\nunbounded command queue. Challenge handling can wait for an asynchronous signer or\nuser interaction, so receiving challenges was substantially faster than completing\nthe corresponding authentication work.\n\nA malicious relay could continuously send new challenges without authenticating or\ndelivering valid events. Every value remained queued, causing memory use and pending\nsigner operations to grow without a fixed limit until the client became unavailable.\nThe issue does not allow the relay to forge a signature or learn the client\u0027s private\nkey.\n\nThe SDK now coalesces pending challenges through a latest-value channel. NIP-42 makes\nan earlier challenge invalid when the relay sends a new one, so replacing pending\nwork preserves the only challenge that can still be answered while keeping memory\nuse bounded.",
"id": "RUSTSEC-2026-0231",
"modified": "2026-08-02T17:56:20Z",
"published": "2026-08-01T12:00:00Z",
"references": [
{
"type": "PACKAGE",
"url": "https://crates.io/crates/nostr-relay-pool"
},
{
"type": "ADVISORY",
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0231.html"
},
{
"type": "WEB",
"url": "https://github.com/nostrdevkit/nostr/commit/6eb8766caa25f03803f178861be054f3bca718d7"
}
],
"related": [],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Relay authentication challenges can exhaust memory"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.