RUSTSEC-2026-0365: Remote DoS through unchecked `IdList` allocation in negentropy

What to do

1. See which version you have: cargo tree -i negentropy (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p negentropy. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example negentropy = "0.5.2") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

Summary

The negentropy crate is vulnerable to denial-of-service through an unchecked, peer-controlled ID count in reconciliation messages.

With the std feature enabled, which is the default configuration, a small malformed message can trigger an enormous memory allocation and terminate the application.

Details

When processing an IdList range, the reconciliation parser uses the peer-provided ID count to reserve memory before checking whether the message contains the corresponding IDs:

let mut their_elems: HashSet<Id> =
    HashSet::with_capacity(num_ids as usize);

An attacker can declare an arbitrarily large count without supplying any IDs. The allocation occurs before the parser reaches the ID-reading loop, which would otherwise reject the truncated message.

With Rust's default allocation-error behavior, a failed allocation aborts the process rather than unwinding. Consequently, catch_unwind cannot contain the failure.

Both reconcile and reconcile_with_ids reach the vulnerable parser.

The patched versions validate the count against the remaining message length before allocating:

if num_ids > (query.len() / ID_SIZE) as u64 {
    return Err(Error::ParseEndsPrematurely);
}

Impact

An unauthenticated remote attacker can terminate an application that exposes reconciliation to untrusted peers without additional validation.

For example, a Nostr relay that forwards NEG-OPEN or NEG-MSG reconciliation payloads to the vulnerable parser can be taken down by a single client message. Clients processing messages from malicious relays are also exposed.

This specific vulnerability affects builds with the default std feature enabled. Builds without std use a BTreeSet and do not perform the vulnerable preallocation.

A message-size limit alone does not prevent exploitation because the malicious payload can be only a few bytes long.

Credit

Discovered and fixed by **Alex Gleason** (<https://github.com/alexgleason>).

References

• Package: crates.io/crates/negentropy
• Advisory: rustsec.org/advisories/RUSTSEC-2026-0365.html
• Web: github.com/nostrdevkit/negentropy/pull/14
• Web: github.com/nostrdevkit/negentropy/commit/40f7290cbc5755a5ba3190279fbc848a97866280
• Web: github.com/nostrdevkit/negentropy/commit/894a32c0ab9f3efd750b3cf06caee27b3f9c3f12

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.