Skip to content
Threat Feed
Subscribe

Product

@Libp2p/Gossipsub

2 briefs RSS
medium advisory

CPU DoS Vulnerability in libp2p gossipsub

A critical vulnerability in the `@libp2p/gossipsub` library allows an unauthenticated attacker to cause a CPU-based Denial of Service by sending oversized IHAVE and IWANT control messages, which are synchronously processed, leading to Node.js event loop exhaustion and service disruption.

@libp2p/gossipsub denial-of-service cpu-exhaustion javascript nodejs library-vulnerability
1t
medium threat

js-libp2p Gossipsub Memory Exhaustion via Subscription Flood

A memory exhaustion vulnerability exists in `@libp2p/gossipsub` due to unbounded subscription handling, allowing a single attacker to exhaust a Node.js heap by flooding unique topic subscriptions, leading to denial-of-service.

js-libp2p +1 dos memory-exhaustion libp2p
1r 2t