PR
Vendor
Protocol
24
CVEs
0
On KEV
0
New 30D
Products
LI8.2
Libp2p
Protocol
6 CVEs0 on KEV0 new
GO8.8
Go-ipfs
Protocol
2 CVEs0 on KEV0 new
GO7.5
Go-ipld-prime
Protocol
2 CVEs0 on KEV0 new
GO9.8
Gossipsub
Protocol
2 CVEs0 on KEV0 new
LI7.5
Libp2p-gossipsub
Protocol
2 CVEs0 on KEV0 new
YA7.5
Yamux
Protocol
2 CVEs0 on KEV0 new
BO7.5
Boxo
Protocol
1 CVEs0 on KEV0 new
GO7.5
Go-bitfield
Protocol
1 CVEs0 on KEV0 new
GO7.5
Go-codec-dagpb
Protocol
1 CVEs0 on KEV0 new
GO7.5
Go-merkledag
Protocol
1 CVEs0 on KEV0 new
GO7.5
Go-unixfs
Protocol
1 CVEs0 on KEV0 new
GO7.5
Go-unixfsnode
Protocol
1 CVEs0 on KEV0 new
IP7.5
Ipfs
Protocol
1 CVEs0 on KEV0 new
MU7.5
Multihash
Protocol
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-35480 | GO Go-ipld-prime Protocol | 6.2 | Apr 7 | go-ipld-prime's DAG-CBOR decoder unbounded memory allocation from CBOR headers |
| CVE-2026-35457 | LI Libp2p Protocol | 8.2 | Apr 7 | libp2p-rust has unbounded rendezvous DISCOVER cookies enable remote memory exhaustion |
| CVE-2026-35405 | LI Libp2p Protocol | 7.5 | Apr 7 | libp2p-rendezvous: Unlimited namespace registrations per peer enables OOM DoS on rendezvous servers |
| CVE-2026-34219 | LI Libp2p-gossipsub Protocol | 5.9 | Mar 31 | libp2p-gossipsub: Gossipsub PRUNE Backoff Heartbeat Instant Overflow |
| CVE-2026-33040 | LI Libp2p-gossipsub Protocol | 7.5 | Mar 20 | libp2p-rust: Gossipsub PRUNE.backoff Duration Overflow |
| CVE-2026-32314 | YA Yamux Protocol | 7.5 | Mar 13 | Yamux remote Panic via malformed Data frame with SYN set and len = 262145 |
| CVE-2026-31814 | YA Yamux Protocol | 7.5 | Mar 13 | Yamux remote Panic via malformed WindowUpdate credit |
| CVE-2023-40583 | LI Libp2p Protocol | 7.5 | Aug 25 | libp2p is a networking stack and library modularized out of The IPFS Project, and bundled separately for other tools to use |
| CVE-2023-25568 | BO Boxo Protocol | 7.5 | May 10 | Boxo, formerly known as go-libipfs, is a library for building IPFS applications and implementations |
| CVE-2023-23631 | GO Go-unixfsnode Protocol | 7.5 | Feb 9 | github.com/ipfs/go-unixfsnode is an ADL IPLD prime node that wraps go-codec-dagpb's implementation of protobuf to enable pathing |
| CVE-2023-23626 | GO Go-bitfield Protocol | 7.5 | Feb 9 | go-bitfield is a simple bitfield package for the go language aiming to be more performant that the standard library |
| CVE-2023-23625 | GO Go-unixfs Protocol | 7.5 | Feb 9 | go-unixfs is an implementation of a unix-like filesystem on top of an ipld merkledag |
| CVE-2023-22460 | GO Go-ipld-prime Protocol | 7.5 | Jan 4 | go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JSON, and tooling for… |
| CVE-2022-2584 | GO Go-codec-dagpb Protocol | 7.5 | Dec 27 | The dag-pb codec can panic when decoding invalid blocks |
| CVE-2022-47547 | GO Gossipsub Protocol | 5.3 | Dec 19 | GossipSub 1.1, as used for Ethereum 2.0, allows a peer to maintain a positive score (and thus not be pruned from the network) even though it continuously misbehaves by never… |
| CVE-2022-23495 | GO Go-merkledag Protocol | 7.5 | Dec 8 | go-merkledag implements the 'DAGService' interface and adds two ipld node types, Protobuf and Raw for the ipfs project |
| CVE-2022-23492 | LI Libp2p Protocol | 7.5 | Dec 8 | go-libp2p is the offical libp2p implementation in the Go programming language |
| CVE-2022-23487 | LI Libp2p Protocol | 7.5 | Dec 7 | js-libp2p is the official javascript Implementation of libp2p networking stack |
| CVE-2022-23486 | LI Libp2p Protocol | 7.5 | Dec 7 | libp2p-rust is the official rust language Implementation of the libp2p networking stack |
| CVE-2020-26283 | GO Go-ipfs Protocol | 8.8 | Mar 24 | go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem |
| CVE-2020-26279 | GO Go-ipfs Protocol | 8.1 | Mar 24 | go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem |
| CVE-2020-35909 | MU Multihash Protocol | 7.5 | Dec 31 | An issue was discovered in the multihash crate before 0.11.3 for Rust |
| CVE-2020-10937 | IP Ipfs Protocol | 7.5 | Nov 2 | An issue was discovered in IPFS (aka go-ipfs) 0.4.23 |
| CVE-2020-12821 | GO Gossipsub Protocol | 9.8 | Jul 7 | Gossipsub 1.0 does not properly resist invalid message spam, such as an eclipse attack or a sybil attack |