High severity · published Dec 7, 2022
CVE-2022-23486
libp2p-rust is the official rust language Implementation of the libp2p networking stack
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
libp2p-rust is the official rust language Implementation of the libp2p networking stack. In versions prior to 0.45.1 an attacker node can cause a victim node to allocate a large number of small memory chunks, which can ultimately lead to the victim’s process running out of memory and thus getting killed by its operating system. When executed continuously, this can lead to a denial of service attack, especially relevant on a larger scale when run against more than one node of a libp2p based network. Users are advised to upgrade to `libp2p` `v0.45.1` or above. Users unable to upgrade should reference the DoS Mitigation page for more information on how to incorporate mitigation strategies, monitor their application, and respond to attacks: https://docs.libp2p.io/reference/dos-mitigation/.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Libp2p · Protocol
before 0.45.1 · source: NVD
Affected product
LI
Libp2p
Protocol
More from Libp2p
8.2
CVE-2026-35457
libp2p-rust has unbounded rendezvous DISCOVER cookies enable remote memory exhaustion
7.5
CVE-2026-35405
libp2p-rendezvous: Unlimited namespace registrations per peer enables OOM DoS on rendezvous servers
7.5
CVE-2023-40583
libp2p is a networking stack and library modularized out of The IPFS Project, and bundled separately for other tools to use
7.5
CVE-2022-23492
go-libp2p is the offical libp2p implementation in the Go programming language
7.5
CVE-2022-23487
js-libp2p is the official javascript Implementation of libp2p networking stack