313 matches found
GHSA-GC42-3JG7-RXR2 Gossipsub PRUNE.backoff Duration Overflow
Summary The Rust libp2p Gossipsub implementation accepts attacker-controlled PRUNE backoff values and may perform unchecked time arithmetic when storing backoff state. A specially crafted PRUNE control message with an extremely large backoff e.g. u64::MAX can lead to Duration/Instant overflow...
blake-streams (0.1.0), fuel-p2p (>=0.4.0, <=0.5.0) +9 more potentially affected by CVE-2026-33040 via libp2p-gossipsub (>=0.28.0, <=0.35.0)
libp2p-gossipsub CARGO version =0.28.0, =0.4.0, =0.20.0, =0.36.0, =0.16.0, =0.1.0, =0.1.1, =0.2.0, =0.39.1, =0.39.3 Source cves: CVE-2026-33040 Source advisory: OSV:GHSA-GC42-3JG7-RXR2...
blake-streams (0.1.0), cs_mwc-libp2p (0.35.3) +41 more potentially affected by CVE-2026-32314 via yamux (>=0.1.9, <=0.10.2)
yamux CARGO version =0.1.9, =0.20.0, =2.0.0-alpha.3, =0.4.0, =0.2.0, =0.20.0, =0.36.0, =0.16.0, =0.1.0, =0.1.1, =0.15.0, =0.19.1 and more Source cves: CVE-2026-32314 Source advisory: OSV:GHSA-VXX9-2994-Q338...
CVE-2022-23486
libp2p-rust is the official rust language Implementation of the libp2p networking stack. In versions prior to 0.45.1 an attacker node can cause a victim node to allocate a large number of small memory chunks, which can ultimately lead to the victim’s process running out of memory and thus getting...
CVE-2022-23487
js-libp2p is the official javascript Implementation of libp2p networking stack. Versions older than v0.38.0 of js-libp2p are vulnerable to targeted resource exhaustion attacks. These attacks target libp2p’s connection, stream, peer, and memory management. An attacker can cause the allocation of...
CVE-2022-23492
go-libp2p is the offical libp2p implementation in the Go programming language. Version 0.18.0 and older of go-libp2p are vulnerable to targeted resource exhaustion attacks. These attacks target libp2p’s connection, stream, peer, and memory management. An attacker can cause the allocation of large...
EUVD-2021-1730
Malware in sbrugna...
EUVD-2021-1561
Malware in sbrugna...
EUVD-2022-1450
Malicious code in bioql PyPI...
EUVD-2023-2242
Malicious code in bioql PyPI...
EUVD-2022-7660
Malicious code in bioql PyPI...
EUVD-2022-7670
Malicious code in bioql PyPI...
EUVD-2023-2291
Malicious code in bioql PyPI...
EUVD-2022-7609
Malicious code in bioql PyPI...
@0xvaibhav/divergent-node (>=0.0.1, <=0.0.3), @0xvaibhav/ipfs-messenger (>=1.0.3, <=1.0.9) +397 more potentially affected by CVE-2025-8020 via private-ip (3.0.2)
private-ip NPM version 3.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on private-ip and may be impacted: - @0xvaibhav/divergent-node =0.0.1, =1.0.3, =0.0.1, =0.0.2, =9.3.0, =1.0.0, =1.3.2, =1.0.1, =1.17.1 - @adminforth/connector-clickhouse 1.0.1 -...
Denial Of Service (DoS)
libp2p is vulnerable to Denial Of Service DoS. The vulnerability is due to insufficient validation of RSA key sizes, which allows an attacker to send a large RSA key and exhaust system resources...
Allocation of Resources Without Limits or Throttling
Overview libp2p is a libp2p: The Python implementation of the libp2p networking stack Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the RSA key handling process. An attacker can exhaust system resources by submitting excessively large...
py-libp2p is vulnerable to DoS attacks through use of large RSA keys
py-libp2p before 0.2.3 allows a peer to cause a denial of service resource consumption via a large RSA key...
