Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
32 results
Oct 18, 2026Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress server (StartIngressServer in cmd/sam-nodCVE-2026-102503 · Computers, phones & browsers · Google · reported by cve-coordination@google.comCritical 9.3
Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress server (StartIngressServer in cmd/sam-node/node.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.2 allow an unauthenticated remote libp2p peer to bypass Biscuit capability policy enforcement and invoke arbitrary registered backend services (including command/stdio-backed MCP servers, A2A, and inference endpoints). While the MCP protocol stream handler enforces WithBiscuitAuth and Authorize checks, the parallel /libp2p-http ingress routes requests directly to backend service handlers without verifying a Biscuit token or mesh enrollment. Users should upgrade to version 0.1.0-alpha.3 or later.
- Product
- SAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026libp2p-rust is the official Rust language implementation of the libp2p networking stack.CVE-2026-95859 · Other software · libp2p · reported by GitHubHigh 8.7
libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.49.5, Gossipsub GRAFT control-message handling unconditionally adds attacker-supplied topic hashes to connected_peer.topics without confirming that the peer previously subscribed to those topics. A remote unauthenticated peer that can reach a Gossipsub listener can repeatedly send novel GRAFT topics, causing cumulative per-peer memory growth that is not bounded by subscription filters, peer scoring, or per-message size limits. This can exhaust process memory and cause a denial of service. This issue is fixed in version 0.49.5.
- Product
- rust-libp2p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026libp2p is a JavaScript implementation of the libp2p networking stack.CVE-2026-103936 · Other software · libp2p · reported by GitHubHigh 7.5
libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 6.0.28, the @libp2p/webrtc webRTCDirect() Node.js listener processes unauthenticated STUN Binding Requests before PeerId authentication, Noise, muxing, protocol negotiation, connection creation, or connection-manager admission. The listener in packages/transport-webrtc/src/private-to-public/utils/stun-listener.ts forwards the packet-controlled request.ufrag into DirectRTCPeerConnection.setLocalDescription, where the value is reused as an ICE password without validating its required length and character set. A short credential causes node-datachannel or libdatachannel to raise an uncaught native invalid_argument and abort the process with SIGABRT, allowing a single remote UDP packet to deny service. The confirmed impact is process termination only, with no demonstrated memory corruption, code execution, browser impact, confidentiality impact, integrity impact, or connection-limit bypass. This issue is fixed in version 6.0.28.
- Product
- js-libp2p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026libp2p is a JavaScript implementation of the libp2p networking stack.CVE-2026-86040 · Other software · libp2p · reported by GitHubHigh 7.5
libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 11.0.26, @libp2p/floodsub accepts unauthenticated RPC frames on /floodsub/1.0.0 through PeerStreams.attachInboundStream in packages/floodsub/src/peer-streams.ts without protobuf element limits, then processRpc and processRpcSubOpt in packages/floodsub/src/floodsub.ts synchronously process the subscriptions array without a per-frame cap. A single bounded-size frame can decode into millions of empty subscription entries that block the event loop, while hundreds of thousands of unique-topic SUBSCRIBE entries allocate PeerSet objects in this.topics that are not removed after peer removal or stop. Empty entries cause CPU exhaustion but do not grow this.topics; persistent memory growth requires unique topics. The subscription path bypasses message signature validation and the message-only processing queue, allowing a remote peer to cause sustained CPU denial of service, memory exhaustion, out-of-memory termination, and node unavailability. The issue is fixed in version 11.0.26.
- Product
- js-libp2p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026libp2p is a JavaScript implementation of the libp2p networking stack.CVE-2026-86039 · Other software · libp2p · reported by GitHubHigh 8.2
libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to verify a RecordEnvelope signature but does not require PeerRecord.peerId in the signed payload to equal the signer peer ID derived by RecordEnvelope.openAndCertify. The expectedPeer option checks only the envelope signer, and the gossipsub Peer Exchange path can provide the attacker's own peer ID as expectedPeer. An attacker can therefore sign a record with the attacker's key, place a victim peer ID and attacker-controlled multiaddrs in the payload, and have certified addresses stored for the victim. The poisoned addresses can cause address-book corruption, dial redirection or failure, routing manipulation, and reachability disruption, although the connection upgrade still verifies remote peer identity and prevents a complete identity takeover. The issue is fixed in version 12.0.24.
- Product
- js-libp2p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026libp2p is a JavaScript implementation of the libp2p networking stack.CVE-2026-86038 · Other software · libp2p · reported by GitHubHigh 7.5
libp2p is a JavaScript implementation of the libp2p networking stack. From 15.0.0 until 16.0.5, @libp2p/gossipsub uses the default StrictSign policy in packages/gossipsub/src/utils/buildRawMessage.ts, where validateToRawMessage verifies a signature with attacker-controlled msg.key but skips binding that key to msg.from when the claimed author is an RSA peer ID that does not inline a public key. An unauthenticated attacker can place a victim RSA peer ID in msg.from, sign the message with the attacker's private key, and supply the attacker's public key in msg.key, causing the message to be accepted and propagated as authored by the victim. Applications that trust message.from for validators, authorization, accounting, moderation, reputation, or audit logging can process attacker-controlled data under false origin attribution. The issue is fixed in version 16.0.5.
- Product
- js-libp2p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026libp2p-rust is the official Rust language implementation of the libp2p networking stack.CVE-2026-61544 · Other software · libp2p · reported by GitHubHigh 8.2
libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.13.1, libp2p-quic could panic during an inbound QUIC handshake when a remote peer presented a valid short-lived libp2p TLS certificate and delayed the final TLS 1.3 handshake fragment until after the certificate expired. In the Quinn post-handshake upgrade path, transports/quic/src/connection/connecting.rs called libp2p_tls::certificate::parse a second time in remote_peer_id and used expect on the result. The repeated wall-clock validity check could reject the now-expired certificate, causing the expect call to terminate any application exposing an affected libp2p-quic listener. This vulnerability is fixed in 0.13.1.
- Product
- rust-libp2p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2026libp2p-rendezvous through 0.17.1 fails to validate registration TTL values in discovery responses, allowing attackers to trigger timer arithmetic overflow.CVE-2026-89146 · Other software · libp2p · reported by VulnCheckHigh 8.7
libp2p-rendezvous through 0.17.1 fails to validate registration TTL values in discovery responses, allowing attackers to trigger timer arithmetic overflow. A malicious rendezvous server can send a discovery response with an unbounded TTL value that causes the client node process to panic when computing the expiry timer.
- Product
- libp2p-rendezvous
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.rsgist.github.com
Aug 24, 2026libp2p is a JavaScript implementation of the libp2p networking stack.CVE-2026-77384 · Other software · libp2p · reported by GitHubHigh 7.5
libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. As a result, a remote peer can repeatedly send valid RESERVE requests for the same reservation, causing unbounded listener and closure growth in @libp2p/circuit-relay-v2 relay servers and leading to denial of service. This issue is fixed in version 4.2.9.
- Product
- js-libp2p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026py-libp2p is the Python implementation of the libp2p networking stack.CVE-2026-73568 · Other software · libp2p · reported by GitHubHigh 7.5
py-libp2p is the Python implementation of the libp2p networking stack. In 0.7.0 and earlier, the yamux handle_incoming() method in libp2p/stream_muxer/yamux/yamux.py reads an attacker-controlled 32-bit DATA frame length with read_exactly() before validating it against MAX_WINDOW_SIZE or checking whether stream_id exists. A peer that completes the standard Noise handshake can send a 12-byte frame declaring a 0xFFFFFFFF body and then withhold the body, causing the sequential yamux read loop used by the default new_host() configuration to block and preventing every stream on that connection from making progress. No fixed version is available as of this review.
- Product
- py-libp2p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026libp2p is a JavaScript Implementation of libp2p networking stack.CVE-2026-49866 · Other software · libp2p · reported by GitHubHigh 7.5
libp2p is a JavaScript Implementation of libp2p networking stack. Prior to 16.0.0, @libp2p/gossipsub defaultDecodeRpcLimits set maxIhaveMessageIDs and maxIwantMessageIDs to Infinity, allowing oversized IHAVE and IWANT control message arrays in message/decodeRpc.ts and gossipsub.ts to synchronously iterate roughly 180,000 message IDs per 4 MB frame and block the Node.js event loop. This issue is fixed in version 16.0.0.
- Product
- js-libp2p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2026libp2p is a JavaScript Implementation of libp2p networking stack.CVE-2026-46679 · Other software · libp2p · reported by GitHubHigh 7.5
libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 15.0.23, three cooperating omissions in @libp2p/gossipsub allow an unauthenticated single peer to exhaust the Node.js heap of any gossipsub node with default options. This issue has been patched in version 15.0.23.
- Product
- js-libp2p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2026libp2p is a JavaScript Implementation of libp2p networking stack.CVE-2026-45783 · Other software · libp2p · reported by GitHubHigh 7.5
libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 16.2.6, an unauthenticated remote peer can exhaust the disk storage of any @libp2p/kad-dht node running in server mode by sending an unbounded stream of PUT_VALUE messages whose keys bypass all content validation. No credentials, no prior relationship, and no protocol deviation beyond a crafted key are required. The victim node's datastore fills until the host disk is exhausted, making the node unavailable. This issue has been patched in version 16.2.6.
- Product
- js-libp2p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026Nimiq's network-libp2p is a Nimiq network implementation based on libp2p.CVE-2026-34063 · Other software · nimiq · reported by GitHubHigh 7.5
Nimiq's network-libp2p is a Nimiq network implementation based on libp2p. Prior to version 1.3.0, `network-libp2p` discovery uses a libp2p `ConnectionHandler` state machine. the handler assumes there is at most one inbound and one outbound discovery substream per connection. if a remote peer opens/negotiate the discovery protocol substream a second time on the same connection, the handler hits a `panic!(\"Inbound already connected\")` / `panic!(\"Outbound already connected\")` path instead of failing closed. This causes a remote crash of the networking task (swarm), taking the node's p2p networking offline until restart. The patch for this vulnerability is formally released as part of v1.3.0. No known workarounds are available.
- Product
- network-libp2p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026nimiq-libp2p is a Nimiq network implementation based on libp2p.CVE-2026-34062 · Other software · nimiq · reported by GitHubMedium 5.3
nimiq-libp2p is a Nimiq network implementation based on libp2p. Prior to version 1.3.0, `MessageCodec::read_request` and `read_response` call `read_to_end()` on inbound substreams, so a remote peer can send only a partial frame and keep the substream open. because `Behaviour::new` also sets `with_max_concurrent_streams(1000)`, the node exposes a much larger stalled-slot budget than the library default. The patch for this vulnerability is formally released as part of v1.3.0. No known workarounds are available.
- Product
- network-libp2p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026libp2p-rust is the official rust language Implementation of the libp2p networking stack.CVE-2026-35457 · Other software · libp2p · reported by GitHubHigh 8.2
libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, the rendezvous server stores pagination cookies without bounds. An unauthenticated peer can repeatedly issue DISCOVER requests and force unbounded memory growth. This vulnerability is fixed in 0.17.1.
- Product
- rust-libp2p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026libp2p-rust is the official rust language Implementation of the libp2p networking stack.CVE-2026-35405 · Other software · libp2p · reported by GitHubHigh 7.5
libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, libp2p-rendezvous server has no limit on how many namespaces a single peer can register. A malicious peer can just keep registering unique namespaces in a loop and the server happily accepts every single one allocating memory for each registration with no pushback. Keep doing this long enough (or with multiple sybil peers) and the server process gets OOM killed. This vulnerability is fixed in 0.17.1.
- Product
- rust-libp2p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026libp2p-rust is the official rust language Implementation of the libp2p networking stack.CVE-2026-34219 · Other software · libp2p · reported by GitHubHigh 8.2
libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to version 0.49.4, the Rust libp2p Gossipsub implementation contains a remotely reachable panic in backoff expiry handling. After a peer sends a crafted PRUNE control message with an attacker-controlled, near-maximum backoff value, the value is accepted and stored as an Instant near the representable upper bound. On a later heartbeat, the implementation performs unchecked Instant + Duration arithmetic (backoff_time + slack), which can overflow and panic with: overflow when adding duration to instant. This issue is reachable from any Gossipsub peer over normal TCP + Noise + mplex/yamux connectivity and requires no further authentication beyond becoming a protocol peer. This issue has been patched in version 0.49.4.
- Product
- rust-libp2p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026libp2p-rust is the official rust language Implementation of the libp2p networking stack.CVE-2026-33040 · Other software · libp2p · reported by GitHubHigh 8.7
libp2p-rust is the official rust language Implementation of the libp2p networking stack. In versions prior to 0.49.3, the Gossipsub implementation accepts attacker-controlled PRUNE backoff values and may perform unchecked time arithmetic when storing backoff state. A specially crafted PRUNE control message with an extremely large backoff (e.g. u64::MAX) can lead to Duration/Instant overflow during backoff update logic, triggering a panic in the networking state machine. This is remotely reachable over a normal libp2p connection and does not require authentication. Any application exposing a libp2p Gossipsub listener and using the affected backoff-handling path can be crashed by a network attacker that can reach the service port. The attack can be repeated by reconnecting and replaying the crafted control message. This issue has been fixed in version 0.49.3.
- Product
- rust-libp2p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP.CVE-2026-32314 · Other software · libp2p · reported by GitHubHigh 8.7
Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. Prior to 0.13.10, the Rust implementation of Yamux can panic when processing a crafted inbound Data frame that sets SYN and uses a body length greater than DEFAULT_CREDIT (e.g. 262145). On the first packet of a new inbound stream, stream state is created and a receiver is queued before oversized-body validation completes. When validation fails, the temporary stream is dropped and cleanup may call remove(...).expect("stream not found"), triggering a panic in the connection state machine. This is remotely reachable over a normal Yamux session and does not require authentication. This vulnerability is fixed in 0.13.10.
- Product
- rust-yamux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2026Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP.CVE-2026-31814 · Other software · libp2p · reported by GitHubHigh 8.7
Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. From 0.13.0 to before 0.13.9, a specially crafted WindowUpdate can cause arithmetic overflow in send-window accounting, which triggers a panic in the connection state machine. This is remotely reachable over a normal network connection and does not require authentication. This vulnerability is fixed in 0.13.9.
- Product
- rust-yamux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025py-libp2p before 0.2.3 allows a peer to cause a denial of service (resource consumption) via a large RSA key.CVE-2025-29606 · Other software · libp2p · reported by MITREMedium 4.3
py-libp2p before 0.2.3 allows a peer to cause a denial of service (resource consumption) via a large RSA key.
- Product
- py-libp2p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2024The Kademlia DHT (go-libp2p-kad-dht 0.20.0 and earlier) used in IPFS (0.18.1 and earlier) assigns routing information for content (i.e., information about who hCVE-2023-26248 · Other software · kademila · reported by MITREMedium 5.3
The Kademlia DHT (go-libp2p-kad-dht 0.20.0 and earlier) used in IPFS (0.18.1 and earlier) assigns routing information for content (i.e., information about who holds the content) to be stored by peers whose peer IDs have a small DHT distance from the content ID. This allows an attacker to censor content by generating many Sybil peers whose peer IDs have a small distance from the content ID, thus hijacking the content resolution process.
- Product
- dht
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2024Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP.CVE-2024-32984 · Other software · libp2p · reported by GitHubHigh 7.5
Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. The Rust implementation of the Yamux stream multiplexer uses a vector for pending frames. This vector is not bounded in length. Every time the Yamux protocol requires sending of a new frame, this frame gets appended to this vector. This can be remotely triggered in a number of ways, for example by: 1. Opening a new libp2p Identify stream. This causes the node to send its Identify message. Of course, every other protocol that causes the sending of data also works. The larger the response, the more data is enqueued. 2. Sending a Yamux Ping frame. This causes a Pong frame to be enqueued. Under normal circumstances, this queue of pending frames would be drained once they’re sent out over the network. However, the attacker can use TCP’s receive window mechanism to prevent the victim from sending out any data: By not reading from the TCP connection, the receive window will never be increased, and the victim won’t be able to send out any new data (this is how TCP implements backpressure). Once this happens, Yamux’s queue of pending frames will start growing indefinitely. The queue will only be drained once th
- Product
- rust-yamux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2023libp2p is a networking stack and library modularized out of The IPFS Project, and bundled separately for other tools to use.CVE-2023-40583 · Other software · libp2p · reported by GitHubHigh 7.5
libp2p is a networking stack and library modularized out of The IPFS Project, and bundled separately for other tools to use. In go-libp2p, by using signed peer records a malicious actor can store an arbitrary amount of data in a remote node’s memory. This memory does not get garbage collected and so the victim can run out of memory and crash. If users of go-libp2p in production are not monitoring memory consumption over time, it could be a silent attack i.e. the attacker could bring down nodes over a period of time (how long depends on the node resources i.e. a go-libp2p node on a virtual server with 4 gb of memory takes about 90 sec to bring down; on a larger server, it might take a bit longer.) This issue was patched in version 0.27.4.
- Product
- go-libp2p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2023go-libp2p is the Go implementation of the libp2p Networking Stack.CVE-2023-39533 · Other software · libp2p · reported by GitHubHigh 7.5
go-libp2p is the Go implementation of the libp2p Networking Stack. Prior to versions 0.27.8, 0.28.2, and 0.29.1 malicious peer can use large RSA keys to run a resource exhaustion attack & force a node to spend time doing signature verification of the large key. This vulnerability is present in the core/crypto module of go-libp2p and can occur during the Noise handshake and the libp2p x509 extension verification step. To prevent this attack, go-libp2p versions 0.27.8, 0.28.2, and 0.29.1 restrict RSA keys to <= 8192 bits. To protect one's application, it is necessary to update to these patch releases and to use the updated Go compiler in 1.20.7 or 1.19.12. There are no known workarounds for this issue.
- Product
- go-libp2p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2022go-libp2p is the offical libp2p implementation in the Go programming language.CVE-2022-23492 · Other software · libp2p · reported by GitHubHigh 7.5
go-libp2p is the offical libp2p implementation in the Go programming language. Version `0.18.0` and older of go-libp2p are vulnerable to targeted resource exhaustion attacks. These attacks target libp2p’s connection, stream, peer, and memory management. An attacker can cause the allocation of large amounts of memory, ultimately leading to the process getting killed by the host’s operating system. While a connection manager tasked with keeping the number of connections within manageable limits has been part of go-libp2p, this component was designed to handle the regular churn of peers, not a targeted resource exhaustion attack. Users are advised to upgrade their version of go-libp2p to version `0.18.1` or newer. Users unable to upgrade may consult the denial of service (dos) mitigation page for more information on how to incorporate mitigation strategies, monitor your application, and respond to attacks.
- Product
- go-libp2p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.libp2p.iogithub.com
Dec 7, 2022js-libp2p is the official javascript Implementation of libp2p networking stack.CVE-2022-23487 · Other software · libp2p · reported by GitHubHigh 7.5
js-libp2p is the official javascript Implementation of libp2p networking stack. Versions older than `v0.38.0` of js-libp2p are vulnerable to targeted resource exhaustion attacks. These attacks target libp2p’s connection, stream, peer, and memory management. An attacker can cause the allocation of large amounts of memory, ultimately leading to the process getting killed by the host’s operating system. While a connection manager tasked with keeping the number of connections within manageable limits has been part of js-libp2p, this component was designed to handle the regular churn of peers, not a targeted resource exhaustion attack. Users are advised to update their js-libp2p dependency to `v0.38.0` or greater. There are no known workarounds for this vulnerability.
- Product
- js-libp2p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2022libp2p-rust is the official rust language Implementation of the libp2p networking stack.CVE-2022-23486 · Other software · libp2p · reported by GitHubHigh 7.5
libp2p-rust is the official rust language Implementation of the libp2p networking stack. In versions prior to 0.45.1 an attacker node can cause a victim node to allocate a large number of small memory chunks, which can ultimately lead to the victim’s process running out of memory and thus getting killed by its operating system. When executed continuously, this can lead to a denial of service attack, especially relevant on a larger scale when run against more than one node of a libp2p based network. Users are advised to upgrade to `libp2p` `v0.45.1` or above. Users unable to upgrade should reference the DoS Mitigation page for more information on how to incorporate mitigation strategies, monitor their application, and respond to attacks: https://docs.libp2p.io/reference/dos-mitigation/.
- Product
- rust-libp2p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2022`@chainsafe/libp2p-noise` contains TypeScript implementation of noise protocol, an encryption protocol used in libp2p.CVE-2022-24759 · Other software · ChainSafe · reported by GitHubHigh 8.1
`@chainsafe/libp2p-noise` contains TypeScript implementation of noise protocol, an encryption protocol used in libp2p. `@chainsafe/libp2p-noise` before 4.1.2 and 5.0.3 does not correctly validate signatures during the handshake process. This may allow a man-in-the-middle to pose as other peers and get those peers banned. Users should upgrade to version 4.1.2 or 5.0.3 to receive a patch. There are currently no known workarounds.
- Product
- js-libp2p-noise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2021An issue was discovered in the libp2p-deflate crate before 0.27.1 for Rust.CVE-2020-36443 · Other software · Libp2p · reported by MITRECritical 9.8
An issue was discovered in the libp2p-deflate crate before 0.27.1 for Rust. An uninitialized buffer is passed to AsyncRead::poll_read(), which is a user-provided trait function.
- Product
- Libp2p-deflate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Aug 26, 2019An issue was discovered in the libp2p-core crate before 0.8.1 for Rust.CVE-2019-15545 · Other software · Libp2p · reported by MITREHigh 7.5
An issue was discovered in the libp2p-core crate before 0.8.1 for Rust. Attackers can spoof ed25519 signatures.
- Product
- Libp2p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.