libp2p 相關的公開 CVE 漏洞與安全風險資訊，提供 CVSS、EPSS、公開時間與漏洞情報資料，協助評估潛在風險與修補優先順序。
| CVE | 摘要 | 來源 | 最高 CVSS | EPSS % | 公開時間 | 更新時間 |
|---|---|---|---|---|---|---|
| CVE-2023-39533 | go-libp2p is the Go implementation of the libp2p Networking Stack. Prior to versions 0.27.8, 0.28.2, and 0.29.1 malicious peer can use large RSA keys to run a resource exhaustion attack & force a node to spend time doing signature verification of the large key. This vulnerability is present in the core/crypto module of go-libp2p and can occur during the Noise handshake and the libp2p x509 extension verification step. To prevent this attack, go-libp2p versions 0.27.8, 0.28.2, and 0.29.1 restrict | [email protected] | 7.5 | 1.08% | 2023-08-08 | 2026-06-17 |
| CVE-2020-36443 | An issue was discovered in the libp2p-deflate crate before 0.27.1 for Rust. An uninitialized buffer is passed to AsyncRead::poll_read(), which is a user-provided trait function. | [email protected] | 9.8 | 1.23% | 2021-08-08 | 2026-06-16 |
| CVE-2019-15545 | An issue was discovered in the libp2p-core crate before 0.8.1 for Rust. Attackers can spoof ed25519 signatures. | [email protected] | 7.5 | 0.77% | 2019-08-26 | 2026-06-16 |