CVE Tools
Track your stack

LIBP2P

3 CVEs tracked since 2022. Since Dec 2022, none of them reached CISA KEV.

LIBP2P CVEs per month

Dec 2022 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
LIBP2P CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2022-1230
2023-013 or fewer
2023-023 or fewer
2023-03no snapshot
2023-043 or fewer
2023-053 or fewer
2023-064 or fewer
2023-073 or fewer
2023-084 or fewer
2023-093 or fewer
2023-104 or fewer
2023-114 or fewer
2023-124 or fewer
2024-014 or fewer
2024-024 or fewer
2024-034 or fewer
2024-044 or fewer
2024-055 or fewer
2024-064 or fewer
2024-074 or fewer
2024-084 or fewer
2024-093 or fewer
2024-104 or fewer
2024-114 or fewer
2024-123 or fewer
2025-014 or fewer
2025-023 or fewer
2025-035 or fewer
2025-044 or fewer
2025-054 or fewer
2025-064 or fewer
2025-075 or fewer
2025-084 or fewer
2025-094 or fewer
2025-104 or fewer
2025-114 or fewer
2025-125 or fewer
2026-015 or fewer
2026-025 or fewer
2026-037 or fewer
2026-046 or fewer
2026-057 or fewer
2026-067 or fewer
2026-077 or fewer
2026-088 or fewer
2026-099 or fewer
2026-106 or fewer

Products

The products that kept showing up in LIBP2P's monthly top three, with their CVEs summed over those months.

  1. Go-libp2p11 month
  2. Js-libp2p11 month
  3. Rust-libp2p11 month

Latest CVEs

The 15 most recently published vulnerabilities affecting LIBP2P.

  1. CVE-2026-95859libp2p-rust: Gossipsub GRAFT topics unbounded growth—
  2. CVE-2026-103936libp2p: Single pre-auth STUN packet terminates `@libp2p/webrtc` WebRTC-direct Node.js listeners7.5
  3. CVE-2026-86040libp2p: Unbounded RPC decode + synchronous subscription processing in @libp2p/floodsub allows unauthenticated DoS7.5
  4. CVE-2026-86039libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses8.2
  5. CVE-2026-86038libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID7.5
  6. CVE-2026-61544libp2p-quic: Remote panic via certificate expiry race during QUIC handshake—
  7. CVE-2026-89146libp2p-rendezvous through 0.17.1 Denial of Service via Unbounded Registration TTL in Discovery Responses7.5
  8. CVE-2026-77384libp2p: Circuit relay v2 server reservation refresh leaks abort listeners and allows remote resource exhaustion7.5
  9. CVE-2026-73568py-libp2p: yamux connection DoS via oversized data frame7.5
  10. CVE-2026-49866libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays7.5
  11. CVE-2026-45783libp2p: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes7.5
  12. CVE-2026-46679libp2p: Memory DoS via subscription flood of unique topics7.5
  13. CVE-2026-35457libp2p-rust has unbounded rendezvous DISCOVER cookies enable remote memory exhaustion8.2
  14. CVE-2026-35405libp2p-rendezvous: Unlimited namespace registrations per peer enables OOM DoS on rendezvous servers7.5
  15. CVE-2026-34219libp2p-gossipsub: Gossipsub PRUNE Backoff Heartbeat Instant Overflow5.9

The record

Peak rank
#182 in Dec 2022
Busiest month shown
Dec 2022, 3 CVEs
Months with a KEV entry
0 since Dec 2022
Monthly snapshots
1 since 2022
LIBP2P's full record, month by month