# cve.now: Libp2p

The newest entries naming Libp2p as an affected vendor (up to 200), of 25 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-95859](https://cve.now/CVE-2026-95859.md): libp2p-rust: Gossipsub GRAFT topics unbounded growth (CVSS 8.7)
- [CVE-2026-103936](https://cve.now/CVE-2026-103936.md): libp2p: Single pre-auth STUN packet terminates \`@libp2p/webrtc\` WebRTC-direct Node.js listeners (CVSS 7.5)
- [CVE-2026-86040](https://cve.now/CVE-2026-86040.md): libp2p: Unbounded RPC decode + synchronous subscription processing in @libp2p/floodsub allows unauthenticated DoS (CVSS 7.5)
- [CVE-2026-86039](https://cve.now/CVE-2026-86039.md): libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses (CVSS 8.2)
- [CVE-2026-86038](https://cve.now/CVE-2026-86038.md): libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID (CVSS 7.5)
- [CVE-2026-61544](https://cve.now/CVE-2026-61544.md): libp2p-quic: Remote panic via certificate expiry race during QUIC handshake (CVSS 8.2)
- [CVE-2026-89146](https://cve.now/CVE-2026-89146.md): libp2p-rendezvous through 0.17.1 Denial of Service via Unbounded Registration TTL in Discovery Responses (CVSS 7.5)
- [CVE-2026-77384](https://cve.now/CVE-2026-77384.md): libp2p: Circuit relay v2 server reservation refresh leaks abort listeners and allows remote resource exhaustion (CVSS 7.5)
- [CVE-2026-73568](https://cve.now/CVE-2026-73568.md): py-libp2p: yamux connection DoS via oversized data frame (CVSS 7.5)
- [CVE-2026-49866](https://cve.now/CVE-2026-49866.md): libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays (CVSS 7.5)
- [CVE-2026-45783](https://cve.now/CVE-2026-45783.md): libp2p: Unvalidated PUT\_VALUE records allow unbounded disk exhaustion on DHT server nodes (CVSS 7.5)
- [CVE-2026-46679](https://cve.now/CVE-2026-46679.md): libp2p: Memory DoS via subscription flood of unique topics (CVSS 7.5)
- [CVE-2026-35457](https://cve.now/CVE-2026-35457.md): libp2p-rust has unbounded rendezvous DISCOVER cookies enable remote memory exhaustion (CVSS 8.2)
- [CVE-2026-35405](https://cve.now/CVE-2026-35405.md): libp2p-rendezvous: Unlimited namespace registrations per peer enables OOM DoS on rendezvous servers (CVSS 7.5)
- [CVE-2026-34219](https://cve.now/CVE-2026-34219.md): libp2p-gossipsub: Gossipsub PRUNE Backoff Heartbeat Instant Overflow (CVSS 8.2)
- [CVE-2026-33040](https://cve.now/CVE-2026-33040.md): libp2p-rust: Gossipsub PRUNE.backoff Duration Overflow (CVSS 8.7)
- [CVE-2026-32314](https://cve.now/CVE-2026-32314.md): Yamux remote Panic via malformed Data frame with SYN set and len = 262145 (CVSS 8.7)
- [CVE-2026-31814](https://cve.now/CVE-2026-31814.md): Yamux remote Panic via malformed WindowUpdate credit (CVSS 8.7)
- [CVE-2025-29606](https://cve.now/CVE-2025-29606.md): py-libp2p before 0.2.3 allows a peer to cause a denial of service (resource consumption) via a large RSA key. (CVSS 4.3)
- [CVE-2024-32984](https://cve.now/CVE-2024-32984.md): Yamux Memory Exhaustion Vulnerability via Active::pending\_frames property (CVSS 7.5)
- [CVE-2023-40583](https://cve.now/CVE-2023-40583.md): libp2p nodes vulnerable to OOM attack (CVSS 7.5)
- [CVE-2023-39533](https://cve.now/CVE-2023-39533.md): libp2p nodes vulnerable to attack using large RSA keys (CVSS 7.5)
- [CVE-2022-23492](https://cve.now/CVE-2022-23492.md): go-libp2p denial of service vulnerability from lack of resource management (CVSS 7.5)
- [CVE-2022-23487](https://cve.now/CVE-2022-23487.md): libp2p denial of service vulnerability from lack of resource management (CVSS 7.5)
- [CVE-2022-23486](https://cve.now/CVE-2022-23486.md): libp2p-rust denial of service vulnerability from lack of resource management (CVSS 7.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/libp2p
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.