Libp2P
Monthly
Remote unauthenticated denial of service in rust-libp2p Gossipsub affects versions prior to 0.49.5 and allows any peer that can reach a Gossipsub listener to repeatedly send novel GRAFT topic hashes. The handler unconditionally records those attacker-supplied topics in the per-peer connected_peer.topics map, so memory grows cumulatively without being bounded by subscription filters, peer scoring, or per-message size limits, eventually exhausting process memory and taking the node down. No public exploit identified at time of analysis; the issue is availability-only (CVSS 4.0 8.7 / assessed CVSS 3.1 7.5), and reachability of the Gossipsub listener is the practical prerequisite.
Unauthenticated remote denial of service in @libp2p/webrtc (the js-libp2p WebRTC transport) before 6.0.28 lets a single crafted UDP STUN Binding Request abort a Node.js webRTCDirect() listener process with SIGABRT, because the attacker-controlled ufrag field is forwarded into DirectRTCPeerConnection.setLocalDescription and reused as the ICE password without any length or character-set validation. The vulnerable code path runs before PeerId authentication, Noise, muxing, protocol negotiation, connection creation, and connection-manager admission, so no credentials, prior connection, or user interaction are required - matching a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5). The confirmed impact is process termination only; no memory corruption, code execution, confidentiallity or integrity impact, browser-side impact, or connection-limit bypass has been demonstrated, and no public exploit code or CISA KEV entry was identified at time of analysis. Affected deployments are limited to Node.js peers that actively expose a webRTCDirect UDP listener; browser peers and nodes without such a listener are unaffected.
Unauthenticated denial of service in @libp2p/floodsub before 11.0.26 (packaged with js-libp2p < 11.0.26) lets a remote peer exhaust CPU and memory by sending a single bounded-size RPC frame on the /floodsub/1.0.0 protocol that decodes into an unbounded number of subscription entries. The affected path (PeerStreams.attachInboundStream → processRpc/processRpcSubOpt) applies no per-frame element limits, bypasses message signature validation and the message-only processing queue, and leaks PeerSet objects in this.topics for unique-topic SUBSCRIBE entries that are never cleaned up, leading to event-loop starvation, out-of-memory termination and node unavailability; no public exploit identified at time of analysis and no KEV listing. Only nodes actually running floodsub with inbound connections from untrusted peers are exposed - the legacy protocol is largely superseded by gossipsub - but for those nodes the attacker needs no authentication, credentials or user interaction (AV:N/AC:L/PR:N/UI:N).
Address-book poisoning in the @libp2p/peer-store component of js-libp2p (8.0.0 up to, but not including, 12.0.24) allows an unauthenticated remote peer to store attacker-controlled multiaddrs as certified addresses under a victim peer ID, because consumePeerRecord validates only the RecordEnvelope signer and never checks that the signed PeerRecord.peerId matches the signer's own peer ID. The gossipsub Peer Exchange path makes this trivially reachable: it lets the attacker supply its own peer ID as the expectedPeer option while naming a victim in the signed payload, so the poisoned addresses are accepted and persisted for the victim, enabling dial redirection, dial failure, routing manipulation and reachability disruption. The connection upgrade still verifies the remote peer's true identity, so full identity takeover or traffic interception is not achieved; no public exploit identified at time of analysis, and the issue is fixed in peer-store 12.0.24 (CVSS 8.2, AV:N/AC:L/PR:N/UI:N/C:N/I:H/A:L, CWE-290).
Forged message authorship in @libp2p/gossipsub 15.0.0 through 16.0.4 lets an unauthenticated, remote attacker sign a gossipsub message with their own key while declaring a victim's RSA peer ID as the author (msg.from), so the message is accepted and propagated as if it came from the victim. The spoofing path is confined to RSA peer IDs that do not inline a public key, since Ed25519 and secp256k1 identities embed the key in the peer ID and cannot be impersonated this way. Impact is integrity-only: applications that make trust, authorization, accounting, moderation, reputation, or audit-log decisions on msg.from can act on attacker-controlled data under a false origin, while deployments that ignore claimed authorship are unaffected. No public exploit code or CISA KEV entry was identified at time of analysis, and the vendor fixed the issue in gossipsub 16.0.5 under CVSS 3.1 base 7.5.
Denial-of-service in libp2p-rendezvous ≤0.17.1 (Rust) allows a malicious rendezvous server to crash any connecting client node by sending a discovery response containing an unbounded TTL value. The client fails to validate the TTL before computing an expiry timer, triggering a CWE-190 integer arithmetic overflow that causes a Rust process panic. A proof-of-concept gist has been published; no confirmed active exploitation has been identified at time of analysis.
Unbounded abort listener accumulation in js-libp2p's circuit-relay-v2 relay server allows any remote peer to exhaust memory and deny service by repeatedly sending valid RESERVE requests for the same reservation slot. The `reservation-store.ts` reservation refresh path reuses an existing `retimeableSignal` but unconditionally registers a new abort listener on every call, causing listeners and their closures to grow without bound. No authentication is required to trigger this, making it exploitable by any peer that can reach the relay server. No public exploit or CISA KEV listing exists at time of analysis, though the unauthenticated network vector and trivial trigger condition make it a credible operational risk for relay operators.
Uncontrolled resource consumption in py-libp2p's yamux stream multiplexer allows any remote peer that completes a standard Noise handshake to permanently stall a connection using a single 12-byte frame. Affected versions 0.7.0 and earlier accept an attacker-controlled 32-bit DATA frame length before validating it against the receive window, so a frame claiming a 4 GB body with no body bytes delivered causes the sequential read loop to block indefinitely, freezing every stream on the connection. No patched release exists at time of analysis; a remediation commit is available upstream, and a proof-of-concept demonstrating the stall is documented in the GHSA advisory.
Rust Yamux prior to version 0.13.10 is vulnerable to denial of service when processing specially crafted inbound stream frames that combine the SYN flag with oversized body lengths, causing the connection handler to panic due to improper state cleanup. An unauthenticated remote attacker can trigger this panic over any normal Yamux session without special privileges, crashing affected applications. No patch is currently available for this high-severity vulnerability.
libp2p is a networking stack and library modularized out of The IPFS Project, and bundled separately for other tools to use. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
go-libp2p is the Go implementation of the libp2p Networking Stack. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
go-libp2p is the offical libp2p implementation in the Go programming language. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
js-libp2p is the official javascript Implementation of libp2p networking stack. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
libp2p-rust is the official rust language Implementation of the libp2p networking stack. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in the libp2p-core crate before 0.8.1 for Rust. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Remote unauthenticated denial of service in rust-libp2p Gossipsub affects versions prior to 0.49.5 and allows any peer that can reach a Gossipsub listener to repeatedly send novel GRAFT topic hashes. The handler unconditionally records those attacker-supplied topics in the per-peer connected_peer.topics map, so memory grows cumulatively without being bounded by subscription filters, peer scoring, or per-message size limits, eventually exhausting process memory and taking the node down. No public exploit identified at time of analysis; the issue is availability-only (CVSS 4.0 8.7 / assessed CVSS 3.1 7.5), and reachability of the Gossipsub listener is the practical prerequisite.
Unauthenticated remote denial of service in @libp2p/webrtc (the js-libp2p WebRTC transport) before 6.0.28 lets a single crafted UDP STUN Binding Request abort a Node.js webRTCDirect() listener process with SIGABRT, because the attacker-controlled ufrag field is forwarded into DirectRTCPeerConnection.setLocalDescription and reused as the ICE password without any length or character-set validation. The vulnerable code path runs before PeerId authentication, Noise, muxing, protocol negotiation, connection creation, and connection-manager admission, so no credentials, prior connection, or user interaction are required - matching a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5). The confirmed impact is process termination only; no memory corruption, code execution, confidentiallity or integrity impact, browser-side impact, or connection-limit bypass has been demonstrated, and no public exploit code or CISA KEV entry was identified at time of analysis. Affected deployments are limited to Node.js peers that actively expose a webRTCDirect UDP listener; browser peers and nodes without such a listener are unaffected.
Unauthenticated denial of service in @libp2p/floodsub before 11.0.26 (packaged with js-libp2p < 11.0.26) lets a remote peer exhaust CPU and memory by sending a single bounded-size RPC frame on the /floodsub/1.0.0 protocol that decodes into an unbounded number of subscription entries. The affected path (PeerStreams.attachInboundStream → processRpc/processRpcSubOpt) applies no per-frame element limits, bypasses message signature validation and the message-only processing queue, and leaks PeerSet objects in this.topics for unique-topic SUBSCRIBE entries that are never cleaned up, leading to event-loop starvation, out-of-memory termination and node unavailability; no public exploit identified at time of analysis and no KEV listing. Only nodes actually running floodsub with inbound connections from untrusted peers are exposed - the legacy protocol is largely superseded by gossipsub - but for those nodes the attacker needs no authentication, credentials or user interaction (AV:N/AC:L/PR:N/UI:N).
Address-book poisoning in the @libp2p/peer-store component of js-libp2p (8.0.0 up to, but not including, 12.0.24) allows an unauthenticated remote peer to store attacker-controlled multiaddrs as certified addresses under a victim peer ID, because consumePeerRecord validates only the RecordEnvelope signer and never checks that the signed PeerRecord.peerId matches the signer's own peer ID. The gossipsub Peer Exchange path makes this trivially reachable: it lets the attacker supply its own peer ID as the expectedPeer option while naming a victim in the signed payload, so the poisoned addresses are accepted and persisted for the victim, enabling dial redirection, dial failure, routing manipulation and reachability disruption. The connection upgrade still verifies the remote peer's true identity, so full identity takeover or traffic interception is not achieved; no public exploit identified at time of analysis, and the issue is fixed in peer-store 12.0.24 (CVSS 8.2, AV:N/AC:L/PR:N/UI:N/C:N/I:H/A:L, CWE-290).
Forged message authorship in @libp2p/gossipsub 15.0.0 through 16.0.4 lets an unauthenticated, remote attacker sign a gossipsub message with their own key while declaring a victim's RSA peer ID as the author (msg.from), so the message is accepted and propagated as if it came from the victim. The spoofing path is confined to RSA peer IDs that do not inline a public key, since Ed25519 and secp256k1 identities embed the key in the peer ID and cannot be impersonated this way. Impact is integrity-only: applications that make trust, authorization, accounting, moderation, reputation, or audit-log decisions on msg.from can act on attacker-controlled data under a false origin, while deployments that ignore claimed authorship are unaffected. No public exploit code or CISA KEV entry was identified at time of analysis, and the vendor fixed the issue in gossipsub 16.0.5 under CVSS 3.1 base 7.5.
Denial-of-service in libp2p-rendezvous ≤0.17.1 (Rust) allows a malicious rendezvous server to crash any connecting client node by sending a discovery response containing an unbounded TTL value. The client fails to validate the TTL before computing an expiry timer, triggering a CWE-190 integer arithmetic overflow that causes a Rust process panic. A proof-of-concept gist has been published; no confirmed active exploitation has been identified at time of analysis.
Unbounded abort listener accumulation in js-libp2p's circuit-relay-v2 relay server allows any remote peer to exhaust memory and deny service by repeatedly sending valid RESERVE requests for the same reservation slot. The `reservation-store.ts` reservation refresh path reuses an existing `retimeableSignal` but unconditionally registers a new abort listener on every call, causing listeners and their closures to grow without bound. No authentication is required to trigger this, making it exploitable by any peer that can reach the relay server. No public exploit or CISA KEV listing exists at time of analysis, though the unauthenticated network vector and trivial trigger condition make it a credible operational risk for relay operators.
Uncontrolled resource consumption in py-libp2p's yamux stream multiplexer allows any remote peer that completes a standard Noise handshake to permanently stall a connection using a single 12-byte frame. Affected versions 0.7.0 and earlier accept an attacker-controlled 32-bit DATA frame length before validating it against the receive window, so a frame claiming a 4 GB body with no body bytes delivered causes the sequential read loop to block indefinitely, freezing every stream on the connection. No patched release exists at time of analysis; a remediation commit is available upstream, and a proof-of-concept demonstrating the stall is documented in the GHSA advisory.
Rust Yamux prior to version 0.13.10 is vulnerable to denial of service when processing specially crafted inbound stream frames that combine the SYN flag with oversized body lengths, causing the connection handler to panic due to improper state cleanup. An unauthenticated remote attacker can trigger this panic over any normal Yamux session without special privileges, crashing affected applications. No patch is currently available for this high-severity vulnerability.
libp2p is a networking stack and library modularized out of The IPFS Project, and bundled separately for other tools to use. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
go-libp2p is the Go implementation of the libp2p Networking Stack. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
go-libp2p is the offical libp2p implementation in the Go programming language. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
js-libp2p is the official javascript Implementation of libp2p networking stack. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
libp2p-rust is the official rust language Implementation of the libp2p networking stack. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in the libp2p-core crate before 0.8.1 for Rust. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.