Skip to content
OpenAdvisories

Product · libp2p

rust-libp2p

7 known vulnerabilities.

rust-libp2p at a glance

Last 12 months
6
Critical · all time
0
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 2 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 2 vulnerabilities Mar April 2026: 2 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 1 vulnerability Sep October 2026: 1 vulnerability November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202610
Sep 202610
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202620
Mar 202620
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400
All Critical High Medium Low Exploited only Public exploit

7 results · Feed

  • High 8.7
    CVE-2026-95859

    libp2p-rust: Gossipsub GRAFT topics unbounded growth

    libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.49.5, Gossipsub GRAFT control-message handling unconditionally adds attacker-supplied topic hashes to connected_peer.topics without confirming that the peer pr…

    libp2p rust-libp2p
  • High 8.2
    CVE-2026-61544

    libp2p-quic: Remote panic via certificate expiry race during QUIC handshake

    libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.13.1, libp2p-quic could panic during an inbound QUIC handshake when a remote peer presented a valid short-lived libp2p TLS certificate and delayed the final TL…

    libp2p rust-libp2p rust-libp2p-identity libp2p-quic Ubuntu crates.io
  • High 8.2
    CVE-2026-35457

    libp2p-rust has unbounded rendezvous DISCOVER cookies enable remote memory exhaustion

    libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, the rendezvous server stores pagination cookies without bounds. An unauthenticated peer can repeatedly issue DISCOVER requests and force unbounded memory…

    libp2p rust-libp2p libp2p-rendezvous crates.io
  • High 7.5
    CVE-2026-35405

    libp2p-rendezvous: Unlimited namespace registrations per peer enables OOM DoS on rendezvous servers

    libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, libp2p-rendezvous server has no limit on how many namespaces a single peer can register. A malicious peer can just keep registering unique namespaces in …

    libp2p rust-libp2p libp2p-rendezvous crates.io
  • High 8.2
    CVE-2026-34219

    libp2p-gossipsub: Gossipsub PRUNE Backoff Heartbeat Instant Overflow

    libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to version 0.49.4, the Rust libp2p Gossipsub implementation contains a remotely reachable panic in backoff expiry handling. After a peer sends a crafted PRUNE contr…

    libp2p rust-libp2p libp2p-gossipsub crates.io
  • High 8.7
    CVE-2026-33040

    libp2p-rust: Gossipsub PRUNE.backoff Duration Overflow

    libp2p-rust is the official rust language Implementation of the libp2p networking stack. In versions prior to 0.49.3, the Gossipsub implementation accepts attacker-controlled PRUNE backoff values and may perform unchecked time arithmetic when storing backoff …

    libp2p rust-libp2p libp2p-gossipsub rust-libp2p-identity Ubuntu crates.io
  • High 7.5
    CVE-2022-23486

    libp2p-rust denial of service vulnerability from lack of resource management

    libp2p-rust is the official rust language Implementation of the libp2p networking stack. In versions prior to 0.45.1 an attacker node can cause a victim node to allocate a large number of small memory chunks, which can ultimately lead to the victim’s process …

    libp2p rust-libp2p libp2p crates.io