Libp2p · weakness class
Denial of Service
16 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
Every one of the 16 is a mark on the map. Named now: 1 to 16, most at risk first.
- libp2p nodes vulnerable to attack using large RSA keys
- go-libp2p denial of service vulnerability from lack of resource management
- libp2p nodes vulnerable to OOM attack
- Yamux Memory Exhaustion Vulnerability via Active::pending_frames property
- libp2p denial of service vulnerability from lack of resource management
- libp2p-rust denial of service vulnerability from lack of resource management
- libp2p: Unbounded RPC decode + synchronous subscription processing in @libp2p/floodsub allows unauthenticated DoS
- libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays
- libp2p: Circuit relay v2 server reservation refresh leaks abort listeners and allows remote resource exhaustion
- py-libp2p: yamux connection DoS via oversized data frame
- libp2p-rendezvous: Unlimited namespace registrations per peer enables OOM DoS on rendezvous servers
- py-libp2p before 0.2.3 allows a peer to cause a denial of service (resource consumption) via a large RSA key.
- libp2p: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes
- libp2p-rust has unbounded rendezvous DISCOVER cookies enable remote memory exhaustion
- libp2p-rust: Gossipsub GRAFT topics unbounded growth
- libp2p: Memory DoS via subscription flood of unique topics
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.