Floodsub
Monthly
Unauthenticated denial of service in @libp2p/floodsub before 11.0.26 (packaged with js-libp2p < 11.0.26) lets a remote peer exhaust CPU and memory by sending a single bounded-size RPC frame on the /floodsub/1.0.0 protocol that decodes into an unbounded number of subscription entries. The affected path (PeerStreams.attachInboundStream → processRpc/processRpcSubOpt) applies no per-frame element limits, bypasses message signature validation and the message-only processing queue, and leaks PeerSet objects in this.topics for unique-topic SUBSCRIBE entries that are never cleaned up, leading to event-loop starvation, out-of-memory termination and node unavailability; no public exploit identified at time of analysis and no KEV listing. Only nodes actually running floodsub with inbound connections from untrusted peers are exposed - the legacy protocol is largely superseded by gossipsub - but for those nodes the attacker needs no authentication, credentials or user interaction (AV:N/AC:L/PR:N/UI:N).
Unauthenticated denial of service in @libp2p/floodsub before 11.0.26 (packaged with js-libp2p < 11.0.26) lets a remote peer exhaust CPU and memory by sending a single bounded-size RPC frame on the /floodsub/1.0.0 protocol that decodes into an unbounded number of subscription entries. The affected path (PeerStreams.attachInboundStream → processRpc/processRpcSubOpt) applies no per-frame element limits, bypasses message signature validation and the message-only processing queue, and leaks PeerSet objects in this.topics for unique-topic SUBSCRIBE entries that are never cleaned up, leading to event-loop starvation, out-of-memory termination and node unavailability; no public exploit identified at time of analysis and no KEV listing. Only nodes actually running floodsub with inbound connections from untrusted peers are exposed - the legacy protocol is largely superseded by gossipsub - but for those nodes the attacker needs no authentication, credentials or user interaction (AV:N/AC:L/PR:N/UI:N).