241 matches found
CVE-2025-29606
The CVE-2025-29606 entry impacts the Python libp2p project (py-libp2p) prior to 0.2.3, where a peer can trigger a DoS by sending a very large RSA key. Root cause: insufficient validation of RSA key sizes, leading to resource exhaustion on the target. Affected component/file is the RSA key handlin...
CVE-2025-29606
py-libp2p before 0.2.3 allows a peer to cause a denial of service resource consumption via a large RSA key...
PT-2025-29420
Name of the Vulnerable Software and Affected Versions: py-libp2p versions prior to 0.2.3 Description: py-libp2p versions prior to 0.2.3 are susceptible to a denial of service resource consumption issue. This occurs when a peer sends a large RSA key. Recommendations: Update py-libp2p to version...
CVE-2025-29606
py-libp2p before 0.2.3 allows a peer to cause a denial of service resource consumption via a large RSA key...
CVE-2025-29606
py-libp2p before 0.2.3 allows a peer to cause a denial of service resource consumption via a large RSA key...
CVE-2020-36443
An issue was discovered in the libp2p-deflate crate before 0.27.1 for Rust. An uninitialized buffer is passed to AsyncRead::pollread, which is a user-provided trait function...
CVE-2019-15545
An issue was discovered in the libp2p-core crate before 0.8.1 for Rust. Attackers can spoof ed25519 signatures...
CVE-2025-47270 nimiq-network-libp2p Uncontrolled Resource Consumption vulnerability
nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. The nimiq-network-libp2p subcrate of nimiq/core-rs-albatross is vulnerable to a Denial of Service DoS attack due to uncontrolled memory allocation. Specifically, the...
Incorrect Synchronization
Overview Affected versions of this package are vulnerable to Incorrect Synchronization in the checkCertId function, when processing multiple concurrent updates to a node's configuration, which can cause a panic. Remediation Upgrade chainmaker.org/chainmaker/net-libp2p/libp2pnet to version 1.2.7 o...
GHSA-MQR9-HJR8-2M9W Content Censorship in the InterPlanetary File System (IPFS) via Kademlia DHT abuse
The Kademlia DHT go-libp2p-kad-dht 0.20.0 and earlier used in IPFS 0.18.1 and earlier assigns routing information for content i.e., information about who holds the content to be stored by peers whose peer IDs have a small DHT distance from the content ID. This allows an attacker to censor content...
CVE-2023-26248
The Kademlia DHT go-libp2p-kad-dht 0.20.0 and earlier used in IPFS 0.18.1 and earlier assigns routing information for content i.e., information about who holds the content to be stored by peers whose peer IDs have a small DHT distance from the content ID. This allows an attacker to censor content...
go-libp2p-kad-dht 安全漏洞
go-libp2p-kad-dht is a distributed hash table algorithm in the libp2p open source. A security vulnerability exists in go-libp2p-kad-dht version 0.20.0 and earlier, which stems from a vulnerability that allows an attacker to hijack the content parsing process by generating a number of Sybil peers...
Security Bulletin: IBM Cloud Pak for Data is vulnerable to resource exhaustion attack due to github.com/Cloudflare/cfssl ( CVE-2023-39533 )
Summary github.com/Cloudflare/cfssl is used by IBM Cloud Pak for Data. CVE-2023-39533. Vulnerability Details CVEID:CVE-2023-39533 DESCRIPTION: libp2p go-libp2p is vulnerable to a denial of service, caused by a flaw during the signature verification. By sending a specially crafted request using...
GHSA-3999-5FFV-WP2R Yamux Memory Exhaustion Vulnerability via Active::pending_frames property
Summary Attack scenario The Rust implementation of the Yamux stream multiplexer uses a vector for pending frames. This vector is not bounded in length. Every time the Yamux protocol requires sending of a new frame, this frame gets appended to this vector. This can be remotely triggered in a numbe...
`libp2p-tokio-socks5` is unmaintained
Note the repository was archived without an issue so we link directly to the commit that marked the repository as unmaintained. To the best of the original authors knowledge the crate has no vulnerabilities as of the last release, it is just unmaintained due to laziness - new maintainer welcome...
RUSTSEC-2024-0334 `libp2p-tokio-socks5` is unmaintained
Note the repository was archived without an issue so we link directly to the commit that marked the repository as unmaintained. To the best of the original authors knowledge the crate has no vulnerabilities as of the last release, it is just unmaintained due to laziness - new maintainer welcome...
Security Bulletin: IBM Planning Analytics Cartridge for IBM Cloud Pak for Data 4.8.0 has addressed security vulnerabilities
Summary IBM Planning Analytics Cartridge for IBM Cloud Pak for Data 4.8.0 resolves vulnerabilities in Golang Go, Gin-Gonic Gin and libp2p go-libp2p. A vulnerability where sensitive information could be shared due to insecure network communication has also been addressed. Please refer to the table...
Security Bulletin: Multiple security vulnerabilities in Go may affect IBM Robotic Process Automation for Cloud Pak
Summary Golang Go is used by IBM Robotic Process Automation for Cloud Pak as part of the operator CVE-2023-29406, CVE-2023-29409. libp2p go-libp2p is used by IBM Robotic Process Automation for Cloud Pak as part of the operator CVE-2023-39533. Vulnerability Details CVEID: CVE-2023-29406 DESCRIPTIO...
CVE-2023-39533
A flaw was found in the go-libp2p package. A malicious peer can use large RSA keys to run a resource exhaustion attack and force a node to spend time doing signature verification of the large key. This issue is present in the core/crypto module of go-libp2p and can occur during the Noise handshak...
GO-2023-2024 Out-of-memory vulnerability in github.com/libp2p/go-libp2p
A malicious actor can store an arbitrary amount of data in the memory of a remote node by sending the node a message with a signed peer record. Signed peer records from randomly generated peers can be sent by a malicious actor. This memory does not get garbage collected and so the remote node can...