@@libp2p

Products

Exploited and recent CVEs

• CVE-2026-95859 High 8.7 libp2p-rust: Gossipsub GRAFT topics unbounded growth 0.3%
• CVE-2026-103936 High 7.5 libp2p: Single pre-auth STUN packet terminates `@libp2p/webrtc` WebRTC-direct Node.js listeners 0.5%
• CVE-2026-103936 High 7.5 libp2p: Single pre-auth STUN packet terminates `@libp2p/webrtc` WebRTC-direct Node.js listeners 0.5%
• CVE-2026-86040 High 7.5 libp2p: Unbounded RPC decode + synchronous subscription processing in @libp2p/floodsub allows unauthenticated DoS 0.7%
• CVE-2026-86040 High 7.5 libp2p: Unbounded RPC decode + synchronous subscription processing in @libp2p/floodsub allows unauthenticated DoS 0.7%
• CVE-2026-86039 High 8.2 libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses 0.3%
• CVE-2026-86038 High 7.5 libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID 0.2%
• CVE-2026-61544 High 8.2 libp2p-quic: Remote panic via certificate expiry race during QUIC handshake 0.3%
• CVE-2026-89146 High 7.5 libp2p-rendezvous through 0.17.1 Denial of Service via Unbounded Registration TTL in Discovery Responses 0.6%
• CVE-2026-77384 High 7.5 libp2p: Circuit relay v2 server reservation refresh leaks abort listeners and allows remote resource exhaustion 0.6%
• CVE-2026-73568 High 7.5 py-libp2p: yamux connection DoS via oversized data frame 0.5%
• CVE-2026-49866 High 7.5 libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays 0.6%
• CVE-2026-45783 High 7.5 libp2p: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes 0.4%
• CVE-2026-46679 High 7.5 libp2p: Memory DoS via subscription flood of unique topics 0.3%
• CVE-2026-35457 High 8.2 libp2p-rust has unbounded rendezvous DISCOVER cookies enable remote memory exhaustion 0.3%
• CVE-2026-35405 High 7.5 libp2p-rendezvous: Unlimited namespace registrations per peer enables OOM DoS on rendezvous servers 0.4%
• CVE-2026-34219 High 8.2 libp2p-gossipsub: Gossipsub PRUNE Backoff Heartbeat Instant Overflow 0.6%
• CVE-2026-33040 High 8.7 libp2p-rust: Gossipsub PRUNE.backoff Duration Overflow 0.6%
• CVE-2026-32314 High 8.7 Yamux remote Panic via malformed Data frame with SYN set and len = 262145 0.5%
• CVE-2026-31814 High 8.7 Yamux remote Panic via malformed WindowUpdate credit 0.5%
• CVE-2025-29606 Medium 4.3 py-libp2p before 0.2.3 allows a peer to cause a denial of service (resource consumption) via a large RSA key. 0.4%
• CVE-2024-32984 High 7.5 Yamux Memory Exhaustion Vulnerability via Active::pending_frames property 0.8%
• CVE-2023-40583 High 7.5 libp2p nodes vulnerable to OOM attack 1.0%
• CVE-2023-39533 High 7.5 libp2p nodes vulnerable to attack using large RSA keys 1.5%
• CVE-2022-23492 High 7.5 go-libp2p denial of service vulnerability from lack of resource management 1.1%
• CVE-2022-23487 High 7.5 libp2p denial of service vulnerability from lack of resource management 0.7%
• CVE-2022-23486 High 7.5 libp2p-rust denial of service vulnerability from lack of resource management 0.7%