CVE-2022-23486 json
libp2p-rust denial of service vulnerability from lack of resource management
published 2022-07-12 4 y ago modified 2026-10-12 27 d ago also GHSA-jvgw-gccv-q5p8 , RUSTSEC-2022-0084 , EUVD-2022-7670
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 54%
- public exploits
- 0
- none known
Summary
libp2p-rust is the official rust language Implementation of the libp2p networking stack. In versions prior to 0.45.1 an attacker node can cause a victim node to allocate a large number of small memory chunks, which can ultimately lead to the victim’s process running out of memory and thus getting killed by its operating system. When executed continuously, this can lead to a denial of service attack, especially relevant on a larger scale when run against more than one node of a libp2p based network. Users are advised to upgrade to `libp2p` `v0.45.1` or above. Users unable to upgrade should reference the DoS Mitigation page for more information on how to incorporate mitigation strategies, monitor their application, and respond to attacks: https://docs.libp2p.io/reference/dos-mitigation/.
Patch / fix
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
0.73% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | libp2p | <0.45.1 >=0.0.0-0, <0.45.1 |
0.45.1 |
Affected products
- libp2p rust-libp2p
Classification
References
-
github.com
/libp2p/rust-libp2p/pull/2697
web
-
github.com
/libp2p/rust-libp2p/security/advisories/GHSA-jvgw-gccv-q5p8
web, third-party-advisory
-
github.com
/libp2p/go-libp2p/security/advisories/GHSA-j7qp-mfxf-8xjw
web
-
github.com
/libp2p/js-libp2p/security/advisories/GHSA-f44q-634c-jvwv
web
-
nvd.nist.gov
/vuln/detail/CVE-2022-23486
advisory
-
github.com
/libp2p/rust-libp2p
package
-
rustsec.org
/advisories/RUSTSEC-2022-0084.html
web, advisory
-
crates.io
/crates/libp2p
package
Sources
- CVE List CVE-2022-23486
- GitHub Advisory GHSA-jvgw-gccv-q5p8
- NVD CVE-2022-23486
- OSV RUSTSEC-2022-0084
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.