TI-2026-27587 CVE-2026-35457 · GHSA-v5hw-cv9c-rpg7
libp2p-rust has unbounded rendezvous DISCOVER cookies enable remote memory exhaustion
Priority HIGH 75
libp2p-rust is the official rust language Implementation of the libp2p networking stack.
Protocol
Records24All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high21CVSS 7.0–8.9
Exploited now
Protocol records in CISA KEVNo Protocol vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
24 records
TI-2026-27541 CVE-2026-35405 · GHSA-cqfx-gf56-8x59
libp2p-rendezvous: Unlimited namespace registrations per peer enables OOM DoS on rendezvous servers
Priority HIGH 72
libp2p-rust is the official rust language Implementation of the libp2p networking stack.
TI-2023-09455 CVE-2023-23626 · GHSA-2h6c-j3gf-xp9r
Denial of service when feeding malformed size arguments in go-bitfield
Priority HIGH 66
go-bitfield is a simple bitfield package for the go language aiming to be more performant that the standard library.
TI-2020-10190 CVE-2020-12821 · GHSA-3fxj-w9rj-xjw3
Gossipsub 1.0 does not properly resist invalid message spam, such as an eclipse attack or a sybil attack.
Priority MEDIUM 46
Gossipsub 1.0 does not properly resist invalid message spam, such as an eclipse attack or a sybil attack.
TI-2026-25486 CVE-2026-33040 · GHSA-gc42-3jg7-rxr2
libp2p-rust: Gossipsub PRUNE.backoff Duration Overflow
Priority MEDIUM 45
libp2p-rust is the official rust language Implementation of the libp2p networking stack.
TI-2026-24842 CVE-2026-32314 · GHSA-vxx9-2994-q338
Yamux remote Panic via malformed Data frame with SYN set and len = 262145
Priority MEDIUM 44
Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP.
TI-2023-10871 CVE-2023-25568 · GHSA-m974-xj4j-7qv5
Boxo bitswap/server: DOS unbounded persistent memory leak
Priority MEDIUM 43
Boxo, formerly known as go-libipfs, is a library for building IPFS applications and implementations.
TI-2022-07554 CVE-2022-23495 · GHSA-x39j-h85h-3f46
ProtoNode may be modified such that common method calls may panic in ipfs/go-merkledag
Priority MEDIUM 42
go-merkledag implements the 'DAGService' interface and adds two ipld node types, Protobuf and Raw for the ipfs project.
TI-2023-21381 CVE-2023-40583 · GHSA-gcq9-qqwx-rgj3
libp2p nodes vulnerable to OOM attack
Priority MEDIUM 41
libp2p is a networking stack and library modularized out of The IPFS Project, and bundled separately for other tools to use.
TI-2023-08709 CVE-2023-22460 · GHSA-c653-6hhg-9x92
go-ipld-prime json codec may panic if asked to encode bytes
Priority MEDIUM 41
go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JSON, and tooling for basic operations on IPLD objects.
TI-2022-07551 CVE-2022-23492 · GHSA-j7qp-mfxf-8xjw
go-libp2p denial of service vulnerability from lack of resource management
Priority MEDIUM 41
go-libp2p is the offical libp2p implementation in the Go programming language.
TI-2020-16104 CVE-2020-26283 · GHSA-r4gv-vj59-cccm
Control character injection in console output
Priority MEDIUM 41
go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem.
TI-2026-24367 CVE-2026-31814 · GHSA-4w32-2493-32g7
Yamux remote Panic via malformed WindowUpdate credit
Priority MEDIUM 40
Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP.
TI-2022-07547 CVE-2022-23487 · GHSA-f44q-634c-jvwv
libp2p denial of service vulnerability from lack of resource management
Priority MEDIUM 40
js-libp2p is the official javascript Implementation of libp2p networking stack.
TI-2022-07546 CVE-2022-23486 · GHSA-jvgw-gccv-q5p8
libp2p-rust denial of service vulnerability from lack of resource management
Priority MEDIUM 40
libp2p-rust is the official rust language Implementation of the libp2p networking stack.
TI-2020-16100 CVE-2020-26279 · GHSA-27pv-q55r-222g
Path traversal in ipfs go-ipfs
Priority LOW 39
go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem.
TI-2026-26514 CVE-2026-34219 · GHSA-xqmp-fxgv-xvq5
libp2p-gossipsub: Gossipsub PRUNE Backoff Heartbeat Instant Overflow
Priority LOW 36
libp2p-rust is the official rust language Implementation of the libp2p networking stack.
TI-2020-18352 CVE-2020-35909 · GHSA-h7qh-3h6f-w79p
An issue was discovered in the multihash crate before 0.11.3 for Rust.
Priority LOW 36
An issue was discovered in the multihash crate before 0.11.3 for Rust.
TI-2023-09460 CVE-2023-23631 · GHSA-4gj3-6r43-3wfc
HAMT Decoding Panics in github.com/ipfs/go-unixfsnode
Priority LOW 35
github.com/ipfs/go-unixfsnode is an ADL IPLD prime node that wraps go-codec-dagpb's implementation of protobuf to enable pathing.
TI-2020-08818 CVE-2020-10937 · GHSA-r23h-3jmw-q7hr
An issue was discovered in IPFS (aka go-ipfs) 0.4.23.
Priority LOW 35
An issue was discovered in IPFS (aka go-ipfs) 0.4.23.
TI-2023-09454 CVE-2023-23625 · GHSA-q264-w97q-q778
Denial of service in HAMT Decoding in go-unixfs
Priority LOW 34
go-unixfs is an implementation of a unix-like filesystem on top of an ipld merkledag.
TI-2022-02386 CVE-2022-2584 · GHSA-g3vv-g2j5-45f2
Panic when decoding invalid blocks in github.com/ipld/go-codec-dagpb
Priority LOW 34
The dag-pb codec can panic when decoding invalid blocks.
TI-2022-23607 CVE-2022-47547 · GHSA-77r2-q4c3-v635
GossipSub 1.1, as used for Ethereum 2.0, allows a peer to maintain a positive score (and…
Priority LOW 31
GossipSub 1.1, as used for Ethereum 2.0, allows a peer to maintain a positive score (and thus not be pruned from the network) even though it continuously misbehaves by never forwarding topic messages.
TI-2026-27610 CVE-2026-35480 · GHSA-378j-3jfj-8r9f
go-ipld-prime's DAG-CBOR decoder unbounded memory allocation from CBOR headers
Priority LOW 27
go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JSON, and tooling for basic operations on IPLD objects.