Protocol
6 CVEs tracked since 2022. Since Dec 2022, none of them reached CISA KEV.
Protocol CVEs per month
| Month | CVEs | In CISA KEV |
|---|---|---|
| 2022-12 | 6 | 0 |
| 2023-01 | 3 or fewer | |
| 2023-02 | 3 or fewer | |
| 2023-03 | no snapshot | |
| 2023-04 | 3 or fewer | |
| 2023-05 | 3 or fewer | |
| 2023-06 | 4 or fewer | |
| 2023-07 | 3 or fewer | |
| 2023-08 | 4 or fewer | |
| 2023-09 | 3 or fewer | |
| 2023-10 | 4 or fewer | |
| 2023-11 | 4 or fewer | |
| 2023-12 | 4 or fewer | |
| 2024-01 | 4 or fewer | |
| 2024-02 | 4 or fewer | |
| 2024-03 | 4 or fewer | |
| 2024-04 | 4 or fewer | |
| 2024-05 | 5 or fewer | |
| 2024-06 | 4 or fewer | |
| 2024-07 | 4 or fewer | |
| 2024-08 | 4 or fewer | |
| 2024-09 | 3 or fewer | |
| 2024-10 | 4 or fewer | |
| 2024-11 | 4 or fewer | |
| 2024-12 | 3 or fewer | |
| 2025-01 | 4 or fewer | |
| 2025-02 | 3 or fewer | |
| 2025-03 | 5 or fewer | |
| 2025-04 | 4 or fewer | |
| 2025-05 | 4 or fewer | |
| 2025-06 | 4 or fewer | |
| 2025-07 | 5 or fewer | |
| 2025-08 | 4 or fewer | |
| 2025-09 | 4 or fewer | |
| 2025-10 | 4 or fewer | |
| 2025-11 | 4 or fewer | |
| 2025-12 | 5 or fewer | |
| 2026-01 | 5 or fewer | |
| 2026-02 | 5 or fewer | |
| 2026-03 | 7 or fewer | |
| 2026-04 | 6 or fewer | |
| 2026-05 | 7 or fewer | |
| 2026-06 | 7 or fewer | |
| 2026-07 | 7 or fewer | |
| 2026-08 | 8 or fewer | |
| 2026-09 | 9 or fewer | |
| 2026-10 | 6 or fewer |
Products
The products that kept showing up in Protocol's monthly top three, with their CVEs summed over those months.
Latest CVEs
The 15 most recently published vulnerabilities affecting Protocol.
- CVE-2026-35480go-ipld-prime's DAG-CBOR decoder unbounded memory allocation from CBOR headers6.2
- CVE-2026-35457libp2p-rust has unbounded rendezvous DISCOVER cookies enable remote memory exhaustion8.2
- CVE-2026-35405libp2p-rendezvous: Unlimited namespace registrations per peer enables OOM DoS on rendezvous servers7.5
- CVE-2026-34219libp2p-gossipsub: Gossipsub PRUNE Backoff Heartbeat Instant Overflow5.9
- CVE-2026-33040libp2p-rust: Gossipsub PRUNE.backoff Duration Overflow7.5
- CVE-2026-32314Yamux remote Panic via malformed Data frame with SYN set and len = 2621457.5
- CVE-2026-31814Yamux remote Panic via malformed WindowUpdate credit7.5
- CVE-2023-40583libp2p nodes vulnerable to OOM attack7.5
- CVE-2023-25568Boxo bitswap/server: DOS unbounded persistent memory leak8.2
- CVE-2023-23625Denial of service in HAMT Decoding in go-unixfs 5.9
- CVE-2023-23626Denial of service when feeding malformed size arguments in go-bitfield5.9
- CVE-2023-23631HAMT Decoding Panics in github.com/ipfs/go-unixfsnode5.9
- CVE-2023-22460go-ipld-prime json codec may panic if asked to encode bytes7.5
- CVE-2022-2584Panic when decoding invalid blocks in github.com/ipld/go-codec-dagpb7.5
- CVE-2022-47547GossipSub 1.1, as used for Ethereum 2.0, allows a peer to maintain a positive score (and thus not be pruned from the network) even though it continuously misbehaves by never forwarding topic messages.5.3
The record
- Peak rank
- #97 in Dec 2022
- Busiest month shown
- Dec 2022, 6 CVEs
- Months with a KEV entry
- 0 since Dec 2022
- Monthly snapshots
- 1 since 2022