L
Vendor security profile
libp2p
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs9
Critical0
CISA KEV0
Public exploit7
Patch rate%22
Avg. CVSS7.7
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
2
5
1
CVE KEV
CVE severity distribution
9toplam CVE
High9 (100%)
Patch and exploitation view
%22
Verified patch
%0
CISA KEV
%78
Public exploit
2Patch available
0Partial
0Workaround
0Vendor: no patch
7Unknown
Latest vulnerabilities
7.5
CVE-2026-103936
libp2p: Single pre-auth STUN packet terminates `@libp2p/webrtc` WebRTC-direct Node.js listeners
L
Patch status unknown
7.5
CVE-2026-86040
libp2p: Unbounded RPC decode + synchronous subscription processing in @libp2p/floodsub allows unauthenticated DoS
L
Patch status unknownEPSS %1
8.2
CVE-2026-86039
libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses
L
Patch status unknownEPSS %0
7.5
CVE-2026-86038
libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID
L
Patch status unknownEPSS %0
8.2
CVE-2026-61544
libp2p-quic: Remote panic via certificate expiry race during QUIC handshake
L
Patch verifiedEPSS %0
7.5
CVE-2026-89146
libp2p-rendezvous through 0.17.1 Denial of Service via Unbounded Registration TTL in Discovery Responses
L
Patch status unknownEPSS %1
7.5
CVE-2026-77384
libp2p: Circuit relay v2 server reservation refresh leaks abort listeners and allows remote resource exhaustion
L
Patch status unknownEPSS %1
7.5
CVE-2026-73568
py-libp2p: yamux connection DoS via oversized data frame
L
Patch status unknownEPSS %0
7.5
CVE-2023-39533
libp2p nodes vulnerable to attack using large RSA keys
L
Patch verifiedEPSS %2