CVE-2026-35480 | Medium | 6.2 | 2026-04-07 | go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JS… |
CVE-2026-35457 | High | 8.2 | 2026-04-07 | libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, the rendezvous server stores pagination cookies witho… |
CVE-2026-35405 | High | 7.5 | 2026-04-07 | libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, libp2p-rendezvous server has no limit on how many nam… |
CVE-2026-34219 | Medium | 5.9 | 2026-03-31 | libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to version 0.49.4, the Rust libp2p Gossipsub implementation cont… |
CVE-2026-33040 | High | 7.5 | 2026-03-20 | libp2p-rust is the official rust language Implementation of the libp2p networking stack. In versions prior to 0.49.3, the Gossipsub implementation accepts atta… |
CVE-2026-32314 | High | 7.5 | 2026-03-16 | Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. Prior to 0.13.10, the Rust implementation of Yamux can panic when processing a… |
CVE-2026-31814 | High | 7.5 | 2026-03-13 | Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. From 0.13.0 to before 0.13.9, a specially crafted WindowUpdate can cause arith… |
CVE-2023-40583 | High | 7.5 | 2023-08-25 | libp2p is a networking stack and library modularized out of The IPFS Project, and bundled separately for other tools to use. In go-libp2p, by using signed peer… |
CVE-2023-25568 | High | 8.2 | 2023-05-10 | Boxo, formerly known as go-libipfs, is a library for building IPFS applications and implementations. In versions 0.4.0 and 0.5.0, if an attacker is able alloca… |
CVE-2023-23631 | Medium | 5.9 | 2023-02-09 | github.com/ipfs/go-unixfsnode is an ADL IPLD prime node that wraps go-codec-dagpb's implementation of protobuf to enable pathing. In versions priot to 1.5.2 tr… |
CVE-2023-23626 | Medium | 5.9 | 2023-02-09 | go-bitfield is a simple bitfield package for the go language aiming to be more performant that the standard library. When feeding untrusted user input into the… |
CVE-2023-23625 | Medium | 5.9 | 2023-02-09 | go-unixfs is an implementation of a unix-like filesystem on top of an ipld merkledag. Trying to read malformed HAMT sharded directories can cause panics and vi… |
CVE-2023-22460 | High | 7.5 | 2023-01-04 | go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JS… |
CVE-2022-2584 | High | 7.5 | 2022-12-27 | The dag-pb codec can panic when decoding invalid blocks. |
CVE-2022-47547 | Medium | 5.3 | 2022-12-19 | GossipSub 1.1, as used for Ethereum 2.0, allows a peer to maintain a positive score (and thus not be pruned from the network) even though it continuously misbe… |
CVE-2022-23495 | High | 7.5 | 2022-12-08 | go-merkledag implements the 'DAGService' interface and adds two ipld node types, Protobuf and Raw for the ipfs project. A `ProtoNode` may be modified in such a… |
CVE-2022-23492 | High | 7.5 | 2022-12-08 | go-libp2p is the offical libp2p implementation in the Go programming language. Version `0.18.0` and older of go-libp2p are vulnerable to targeted resource exha… |
CVE-2022-23487 | High | 7.5 | 2022-12-07 | js-libp2p is the official javascript Implementation of libp2p networking stack. Versions older than `v0.38.0` of js-libp2p are vulnerable to targeted resource… |
CVE-2022-23486 | High | 7.5 | 2022-12-07 | libp2p-rust is the official rust language Implementation of the libp2p networking stack. In versions prior to 0.45.1 an attacker node can cause a victim node t… |
CVE-2020-26283 | Medium | 6.8 | 2021-03-24 | go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0, control charact… |
CVE-2020-26279 | High | 7.7 | 2021-03-24 | go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0-rc1, it is possi… |
CVE-2020-35909 | High | 7.5 | 2020-12-31 | An issue was discovered in the multihash crate before 0.11.3 for Rust. The from_slice parsing code can panic via unsanitized data from a network server. |
CVE-2020-10937 | High | 7.5 | 2020-11-02 | An issue was discovered in IPFS (aka go-ipfs) 0.4.23. An attacker can generate ephemeral identities (Sybils) and leverage the IPFS connection management reputa… |
CVE-2020-12821 | Critical | 9.8 | 2020-07-07 | Gossipsub 1.0 does not properly resist invalid message spam, such as an eclipse attack or a sybil attack. |