CVE-2026-46679: Kademlia Dht Insufficient Initial Peers

The query manager selects only 'd' closest peers rather than 'k' closest peers for routing table initialization. This drastically weakens the robustness of disjoint lookup paths, making the DHT vulnerable to eclipse attacks. Ensure the routing table closest peers matches the expected bucket size 'k' before routing them into separate initial paths.

Provally CuratedPublic repositoryMediumMedium confidenceVerifiedApache-2.0TS
greprules fetch cve-2026-46679-kademlia-dht-insufficient-initial-peers --engine opengrep

Description

The query manager selects only 'd' closest peers rather than 'k' closest peers for routing table initialization. This drastically weakens the robustness of disjoint lookup paths, making the DHT vulnerable to eclipse attacks. Ensure the routing table closest peers matches the expected bucket size 'k' before routing them into separate initial paths.