Skip to content
Libp2p vulnerabilities
Newest
-
libp2p rust-libp2p
libp2p-rust: Gossipsub GRAFT topics unbounded growth
CVE-2026-95859
8.7 High
-
@libp2p webrtc, libp2p js-libp2p +1 more
libp2p: Single pre-auth STUN packet terminates `@libp2p/webrtc` WebRTC-direct Node.js listeners
CVE-2026-103936
7.5 High
-
@libp2p floodsub, libp2p js-libp2p +1 more
libp2p: Unbounded RPC decode + synchronous subscription processing in @libp2p/floodsub allows unauthenticated DoS
CVE-2026-86040
7.5 High
-
libp2p js-libp2p
libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses
CVE-2026-86039
Fix available
8.2 High
-
libp2p js-libp2p
libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID
CVE-2026-86038
Fix available
7.5 High
-
libp2p rust-libp2p
libp2p-quic: Remote panic via certificate expiry race during QUIC handshake
CVE-2026-61544
Fix available
8.2 High
-
libp2p libp2p-rendezvous
libp2p-rendezvous through 0.17.1 Denial of Service via Unbounded Registration TTL in Discovery Responses
CVE-2026-89146
8.7 High
-
libp2p js-libp2p
libp2p: Circuit relay v2 server reservation refresh leaks abort listeners and allows remote resource exhaustion
CVE-2026-77384
7.5 High
-
libp2p py-libp2p
py-libp2p: yamux connection DoS via oversized data frame
CVE-2026-73568
7.5 High
-
libp2p js-libp2p
libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays
CVE-2026-49866
Fix available
7.5 High
-
libp2p js-libp2p
libp2p: Memory DoS via subscription flood of unique topics
CVE-2026-46679
Fix available
7.5 High
-
libp2p js-libp2p
libp2p: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes
CVE-2026-45783
Fix available
7.5 High
-
protocol libp2p, libp2p rust-libp2p +1 more
libp2p-rust has unbounded rendezvous DISCOVER cookies enable remote memory exhaustion
CVE-2026-35457
Fix available
8.2 High
-
protocol libp2p, libp2p rust-libp2p +1 more
libp2p-rendezvous: Unlimited namespace registrations per peer enables OOM DoS on rendezvous servers
CVE-2026-35405
Fix available
7.5 High
-
protocol libp2p-gossipsub, libp2p rust-libp2p +1 more
libp2p-gossipsub: Gossipsub PRUNE Backoff Heartbeat Instant Overflow
CVE-2026-34219
Fix available
8.2 High
-
libp2p rust-libp2p, protocol libp2p-gossipsub +1 more
libp2p-rust: Gossipsub PRUNE.backoff Duration Overflow
CVE-2026-33040
Fix available
8.7 High
-
protocol yamux, libp2p rust-yamux +1 more
Yamux remote Panic via malformed Data frame with SYN set and len = 262145
CVE-2026-32314
Fix available
8.7 High
-
protocol yamux, libp2p rust-yamux +1 more
Yamux remote Panic via malformed WindowUpdate credit
CVE-2026-31814
Fix available
8.7 High
-
libp2p py-libp2p
py-libp2p is vulnerable to DoS attacks through use of large RSA keys
CVE-2025-29606
Fix available
4.3 Medium
-
libp2p rust-yamux, rust yamux +1 more
Yamux Memory Exhaustion Vulnerability via Active::pending_frames property
CVE-2024-32984
Fix available
7.5 High
-
libp2p go-libp2p, protocol libp2p +1 more
libp2p nodes vulnerable to OOM attack
CVE-2023-40583
Fix available
7.5 High
-
libp2p go-libp2p
libp2p nodes vulnerable to attack using large RSA keys
CVE-2023-39533
Fix available
7.5 High
-
libp2p go-libp2p, protocol libp2p +1 more
go-libp2p denial of service vulnerability from lack of resource management
CVE-2022-23492
Fix available
7.5 High
-
libp2p js-libp2p, protocol libp2p +1 more
libp2p denial of service vulnerability from lack of resource management
CVE-2022-23487
Fix available
7.5 High
-
protocol libp2p, libp2p rust-libp2p +1 more
libp2p-rust denial of service vulnerability from lack of resource management
CVE-2022-23486
Fix available
7.5 High
-
libp2p libp2p-deflate
Use of Uninitialized Resource in libp2p-deflate
CVE-2020-36443
Fix available
9.8 Critical
-
libp2p
Failure to properly verify ed25519 signatures in libp2p-core
CVE-2019-15545
Fix available
7.5 High