Libp2p vulnerabilities
25 CVEs and advisories name Libp2p as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-95859libp2p-rust: Gossipsub GRAFT topics unbounded growth
- CVE-2026-103936libp2p: Single pre-auth STUN packet terminates `@libp2p/webrtc` WebRTC-direct Node.js listeners
- CVE-2026-86040libp2p: Unbounded RPC decode + synchronous subscription processing in @libp2p/floodsub allows unauthenticated DoS
- CVE-2026-86039libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses
- CVE-2026-86038libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID
- CVE-2026-61544libp2p-quic: Remote panic via certificate expiry race during QUIC handshake
- CVE-2026-89146libp2p-rendezvous through 0.17.1 Denial of Service via Unbounded Registration TTL in Discovery Responses
- CVE-2026-77384libp2p: Circuit relay v2 server reservation refresh leaks abort listeners and allows remote resource exhaustion
- CVE-2026-73568py-libp2p: yamux connection DoS via oversized data frame
- CVE-2026-49866libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays
- CVE-2026-45783libp2p: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes
- CVE-2026-46679libp2p: Memory DoS via subscription flood of unique topics
- CVE-2026-35457libp2p-rust has unbounded rendezvous DISCOVER cookies enable remote memory exhaustion
- CVE-2026-35405libp2p-rendezvous: Unlimited namespace registrations per peer enables OOM DoS on rendezvous servers
- CVE-2026-34219libp2p-gossipsub: Gossipsub PRUNE Backoff Heartbeat Instant Overflow
- CVE-2026-33040libp2p-rust: Gossipsub PRUNE.backoff Duration Overflow
- CVE-2026-32314Yamux remote Panic via malformed Data frame with SYN set and len = 262145
- CVE-2026-31814Yamux remote Panic via malformed WindowUpdate credit
- CVE-2025-29606py-libp2p before 0.2.3 allows a peer to cause a denial of service (resource consumption) via a large RSA key.
- CVE-2024-32984Yamux Memory Exhaustion Vulnerability via Active::pending_frames property
- CVE-2023-40583libp2p nodes vulnerable to OOM attack
- CVE-2023-39533libp2p nodes vulnerable to attack using large RSA keys
- CVE-2022-23492go-libp2p denial of service vulnerability from lack of resource management
- CVE-2022-23487libp2p denial of service vulnerability from lack of resource management
- CVE-2022-23486libp2p-rust denial of service vulnerability from lack of resource management