Protocol vulnerabilities

Products

• Libp2p 6
• Go-ipfs 2
• Go-ipld-prime 2
• Gossipsub 2
• Libp2p-gossipsub 2
• Yamux 2

Newest

• ipld go-ipld-prime go-ipld-prime's DAG-CBOR decoder unbounded memory allocation from CBOR headers CVE-2026-35480 Fix available 6.2 MediumApril 6, 2026
• protocol libp2p, libp2p rust-libp2p +1 more libp2p-rust has unbounded rendezvous DISCOVER cookies enable remote memory exhaustion CVE-2026-35457 Fix available 8.2 HighApril 4, 2026
• protocol libp2p, libp2p rust-libp2p +1 more libp2p-rendezvous: Unlimited namespace registrations per peer enables OOM DoS on rendezvous servers CVE-2026-35405 Fix available 7.5 HighApril 4, 2026
• protocol libp2p-gossipsub, libp2p rust-libp2p +1 more libp2p-gossipsub: Gossipsub PRUNE Backoff Heartbeat Instant Overflow CVE-2026-34219 Fix available 8.2 HighMarch 30, 2026
• libp2p rust-libp2p, protocol libp2p-gossipsub +1 more libp2p-rust: Gossipsub PRUNE.backoff Duration Overflow CVE-2026-33040 Fix available 8.7 HighMarch 18, 2026
• protocol yamux, libp2p rust-yamux +1 more Yamux remote Panic via malformed Data frame with SYN set and len = 262145 CVE-2026-32314 Fix available 8.7 HighMarch 13, 2026
• protocol yamux, libp2p rust-yamux +1 more Yamux remote Panic via malformed WindowUpdate credit CVE-2026-31814 Fix available 8.7 HighMarch 13, 2026
• libp2p go-libp2p, protocol libp2p +1 more libp2p nodes vulnerable to OOM attack CVE-2023-40583 Fix available 7.5 HighAugust 24, 2023
• ipfs boxo Boxo bitswap/server: DOS unbounded persistent memory leak CVE-2023-25568 Fix available 8.2 HighMay 10, 2023
• ipfs go-unixfs Denial of service in HAMT Decoding in go-unixfs CVE-2023-23625 Fix available 5.9 MediumFebruary 9, 2023
• ipfs go-bitfield Denial of service when feeding malformed size arguments in go-bitfield CVE-2023-23626 Fix available 5.9 MediumFebruary 9, 2023
• ipfs go-unixfsnode HAMT Decoding Panics in github.com/ipfs/go-unixfsnode CVE-2023-23631 Fix available 5.9 MediumFebruary 9, 2023
• ipld go-ipld-prime go-ipld-prime json codec may panic if asked to encode bytes CVE-2023-22460 Fix available 7.5 HighJanuary 4, 2023
• protocol gossipsub GossipSub 1.1, as used for Ethereum 2.0, allows a peer to maintain a positive score (and thus not... CVE-2022-47547 5.3 MediumDecember 19, 2022
• ipfs go-merkledag ProtoNode may be modified such that common method calls may panic in ipfs/go-merkledag CVE-2022-23495 Fix available 7.5 HighDecember 8, 2022
• libp2p go-libp2p, protocol libp2p +1 more go-libp2p denial of service vulnerability from lack of resource management CVE-2022-23492 Fix available 7.5 HighDecember 7, 2022
• libp2p js-libp2p, protocol libp2p +1 more libp2p denial of service vulnerability from lack of resource management CVE-2022-23487 Fix available 7.5 HighDecember 7, 2022
• protocol libp2p, libp2p rust-libp2p +1 more libp2p-rust denial of service vulnerability from lack of resource management CVE-2022-23486 Fix available 7.5 HighJuly 12, 2022
• github.com/ipld/go-codec-dagpb, protocol go-codec-dagpb +1 more Panic when decoding invalid blocks in github.com/ipld/go-codec-dagpb CVE-2022-2584 Fix available 7.5 HighApril 8, 2022
• ipfs go-ipfs Control character injection in console output CVE-2020-26283 Fix available 6.8 MediumMarch 24, 2021
• ipfs go-ipfs Path traversal CVE-2020-26279 Fix available 7.7 HighMarch 24, 2021
• protocol multihash Unexpected panic in multihash CVE-2020-35909 Fix available 7.5 HighNovember 8, 2020
• protocol ipfs Access Restriction Bypass in go-ipfs CVE-2020-10937 Fix available 7.5 HighNovember 2, 2020
• protocol gossipsub Gossipsub 1.0 does not properly resist invalid message spam, such as an eclipse attack or a sybil... CVE-2020-12821 9.8 CriticalJuly 7, 2020