These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A remote unauthenticated peer can cause a denial of service by repeatedly sending novel GRAFT topics to a Gossipsub listener in libp2p-rust versions prior to 0.49.5. This issue is fixed in version 0.49.5. The vulnerability allows cumulative per-peer memory growth, potentially leading to memory exhaustion and impacting availability. Defenders should assess exposure and prioritize updating to version 0.49.5 [truncated]
libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to verify a RecordEnvelope signature but does not require PeerRecord.peerId in the signed payload to equal the signer peer ID derived by RecordEnvelope.openAndCertify. The expectedPeer option checks only the envelope signer, and the g [truncated]
libp2p-rendezvous through 0.17.1 fails to validate registration TTL values in discovery responses, allowing attackers to trigger timer arithmetic overflow. A malicious rendezvous server can send a discovery response with an unbounded TTL value that causes the client node process to panic when computing the expiry timer. This vulnerability affects defenders responsible for libp2p-rendezvous deployments, wh [truncated]
libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. As a result, a remote peer can repeatedly send valid RESERVE requests for the same reservation, causing unbounded listener and closure growth in @libp2p/circ [truncated]
A denial-of-service vulnerability exists in py-libp2p versions 0.7.0 and earlier. An attacker can exploit this vulnerability by sending a specially crafted 12-byte frame declaring a 0xFFFFFFFF body and then withholding the body, causing the sequential yamux read loop to block and preventing every stream on that connection from making progress. This issue impacts network availability and reliability, and d [truncated]
libp2p is a JavaScript Implementation of libp2p networking stack. Prior to 16.0.0, @libp2p/gossipsub defaultDecodeRpcLimits set maxIhaveMessageIDs and maxIwantMessageIDs to Infinity, allowing oversized IHAVE and IWANT control message arrays in message/decodeRpc.ts and gossipsub.ts to synchronously iterate roughly 180,000 message IDs per 4 MB frame and block the Node.js event loop. This issue is fixed in v [truncated]
CVE-2026-46679 is a HIGH severity vulnerability in libp2p's gossipsub. Prior to version 15.0.23, three cooperating omissions allow an unauthenticated single peer to exhaust the Node.js heap of any gossipsub node with default options. This issue has been patched in version 15.0.23.
CVE-2026-45783 is a HIGH severity vulnerability in libp2p, a JavaScript Implementation of libp2p networking stack. An unauthenticated remote peer can exhaust a @libp2p/kad-dht node's disk storage by sending an unbounded stream of PUT_VALUE messages with crafted keys, making the node unavailable. This issue was patched in version 16.2.6.
CVE-2026-34219 is a high-severity vulnerability in the libp2p-rust Gossipsub implementation. Prior to version 0.49.4, a remotely reachable panic occurs in backoff expiry handling. An attacker can send a crafted PRUNE control message with a near-maximum backoff value, causing an overflow and panic when adding duration to instant. This issue is reachable from any Gossipsub peer over normal TCP + Noise + mpl [truncated]