LI
Vendor
libp2p
24
CVEs
0
On KEV
3
New 30D
Products
JS8.2
js-libp2p
libp2p
8 CVEs0 on KEV1 new
RU8.7
rust-libp2p
libp2p
6 CVEs0 on KEV1 new
WE7.5
webrtc
@libp2p
1 CVEs0 on KEV1 new
PY7.5
py-libp2p
libp2p
2 CVEs0 on KEV0 new
RU7.5
rust-yamux
libp2p
2 CVEs0 on KEV0 new
FL7.5
floodsub
@libp2p
1 CVEs0 on KEV0 new
GO7.5
Go-libp2p
Libp2p
1 CVEs0 on KEV0 new
LI7.5
Libp2p
Libp2p
1 CVEs0 on KEV0 new
LI9.8
Libp2p-deflate
Libp2p
1 CVEs0 on KEV0 new
LI7.5
libp2p-rendezvous
libp2p
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-95859 | RU rust-libp2p libp2p | 8.7 | Oct 16 | libp2p-rust: Gossipsub GRAFT topics unbounded growth |
| CVE-2026-103936 | WE webrtc @libp2p | 7.5 | Oct 15 | libp2p: Single pre-auth STUN packet terminates `@libp2p/webrtc` WebRTC-direct Node.js listeners |
| CVE-2026-86040 | FL floodsub @libp2p | 7.5 | Sep 17 | libp2p: Unbounded RPC decode + synchronous subscription processing in @libp2p/floodsub allows unauthenticated DoS |
| CVE-2026-86039 | JS js-libp2p libp2p | 8.2 | Sep 17 | libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses |
| CVE-2026-86038 | JS js-libp2p libp2p | 7.5 | Sep 17 | libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID |
| CVE-2026-61544 | RU rust-libp2p libp2p | 8.2 | Sep 15 | libp2p-quic: Remote panic via certificate expiry race during QUIC handshake |
| CVE-2026-89146 | LI libp2p-rendezvous libp2p | 7.5 | Sep 11 | libp2p-rendezvous through 0.17.1 Denial of Service via Unbounded Registration TTL in Discovery Responses |
| CVE-2026-77384 | JS js-libp2p libp2p | 7.5 | Aug 24 | libp2p: Circuit relay v2 server reservation refresh leaks abort listeners and allows remote resource exhaustion |
| CVE-2026-73568 | PY py-libp2p libp2p | 7.5 | Aug 13 | py-libp2p: yamux connection DoS via oversized data frame |
| CVE-2026-49866 | JS js-libp2p libp2p | 7.5 | Jul 8 | libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays |
| CVE-2026-45783 | JS js-libp2p libp2p | 7.5 | Jun 10 | libp2p: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes |
| CVE-2026-46679 | JS js-libp2p libp2p | 7.5 | Jun 10 | libp2p: Memory DoS via subscription flood of unique topics |
| CVE-2026-35457 | RU rust-libp2p libp2p | 8.2 | Apr 7 | libp2p-rust has unbounded rendezvous DISCOVER cookies enable remote memory exhaustion |
| CVE-2026-35405 | RU rust-libp2p libp2p | 7.5 | Apr 7 | libp2p-rendezvous: Unlimited namespace registrations per peer enables OOM DoS on rendezvous servers |
| CVE-2026-34219 | RU rust-libp2p libp2p | 5.9 | Mar 31 | libp2p-gossipsub: Gossipsub PRUNE Backoff Heartbeat Instant Overflow |
| CVE-2026-33040 | RU rust-libp2p libp2p | 7.5 | Mar 20 | libp2p-rust: Gossipsub PRUNE.backoff Duration Overflow |
| CVE-2026-32314 | RU rust-yamux libp2p | 7.5 | Mar 13 | Yamux remote Panic via malformed Data frame with SYN set and len = 262145 |
| CVE-2026-31814 | RU rust-yamux libp2p | 7.5 | Mar 13 | Yamux remote Panic via malformed WindowUpdate credit |
| CVE-2025-29606 | PY py-libp2p libp2p | 4.3 | Jul 14 | py-libp2p before 0.2.3 allows a peer to cause a denial of service (resource consumption) via a large RSA key |
| CVE-2023-39533 | GO Go-libp2p Libp2p | 7.5 | Aug 8 | go-libp2p is the Go implementation of the libp2p Networking Stack |
| CVE-2020-36443 | LI Libp2p-deflate Libp2p | 9.8 | Aug 8 | An issue was discovered in the libp2p-deflate crate before 0.27.1 for Rust |
| CVE-2019-15545 | LI Libp2p Libp2p | 7.5 | Aug 26 | An issue was discovered in the libp2p-core crate before 0.8.1 for Rust |