Skip to content
Threat Feed
Subscribe

Tag

Libp2p

7 briefs RSS
medium advisory

Remote Denial of Service in libp2p-quic via Certificate Expiry Race

A malicious peer can trigger an application crash in libp2p-quic (< 0.13.1) by initiating a QUIC handshake and delaying the final TLS fragment until the peer certificate expires, causing an unhandled panic.

libp2p-quic denial-of-service libp2p rust
1t 1c
low advisory

Denial of Service Vulnerability in libp2p-rendezvous

A vulnerability in libp2p-rendezvous through version 0.17.1 allows malicious rendezvous servers to crash client nodes by providing an unbounded registration TTL value.

libp2p-rendezvous denial-of-service vulnerability libp2p
1c
medium advisory

py-libp2p yamux Connection DoS via Oversized Data Frame

A denial-of-service vulnerability in py-libp2p versions up to 0.6.0 allows an authenticated attacker to send a specially crafted 12-byte DATA or SYN frame with an oversized length field, causing the victim's yamux read loop to block indefinitely and freezing all streams on the affected connection.

py-libp2p denial-of-service vulnerability network python libp2p
1t
medium threat

js-libp2p Gossipsub Memory Exhaustion via Subscription Flood

A memory exhaustion vulnerability exists in `@libp2p/gossipsub` due to unbounded subscription handling, allowing a single attacker to exhaust a Node.js heap by flooding unique topic subscriptions, leading to denial-of-service.

js-libp2p +1 dos memory-exhaustion libp2p
1r 2t
medium threat

@libp2p/kad-dht Unvalidated PUT_VALUE Records Allow Unbounded Disk Exhaustion

An unauthenticated remote peer can exhaust the disk storage of any `@libp2p/kad-dht` node running in server mode by sending an unbounded stream of `PUT_VALUE` messages with crafted keys to bypass validation and cause disk exhaustion.

@libp2p/kad-dht libp2p kad-dht denial-of-service disk-exhaustion
2r 2t
high advisory

libp2p-rendezvous Unlimited Namespace Registration DoS

A vulnerable libp2p-rendezvous server can be crashed via a denial-of-service attack where an unauthenticated peer registers unlimited namespaces, leading to memory exhaustion.

libp2p rendezvous denial-of-service
2r 1t
high advisory

libp2p-gossipsub Remote Denial of Service via Integer Overflow

A remote, unauthenticated attacker can crash applications using libp2p-gossipsub versions prior to 0.49.4 by sending a crafted PRUNE control message with a near-maximum backoff value, causing an arithmetic overflow during heartbeat processing.

libp2p gossipsub denial-of-service integer overflow rust
2r 1t