CVE-2022-23486

libp2p-rust is the official rust language Implementation of the libp2p networking stack. In versions prior to 0.45.1 an attacker node can cause a victim node to allocate a large number of small memory chunks, which can ultimately lead to the victim’s process running out of memory and thus getting killed by its operating system. When executed continuously, this can lead to a denial of service attack, especially relevant on a larger scale when run against more than one node of a libp2p based network. Users are advised to upgrade to `libp2p` `v0.45.1` or above. Users unable to upgrade should reference the DoS Mitigation page for more information on how to incorporate mitigation strategies, monitor their application, and respond to attacks: https://docs.libp2p.io/reference/dos-mitigation/.

• CWE-400
• CWE-770

• https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-jvgw-gccv-q5p8Third Party Advisory
• https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-jvgw-gccv-q5p8Third Party Advisory

Published

Dec 7, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-23480xrdp is an open source project which provides a graphical lo…9.8
• CVE-2022-23481xrdp is an open source project which provides a graphical lo…9.1
• CVE-2022-23482xrdp is an open source project which provides a graphical lo…9.1
• CVE-2022-23483xrdp is an open source project which provides a graphical lo…9.1
• CVE-2022-23484xrdp is an open source project which provides a graphical lo…9.8
• CVE-2022-23485Sentry is an error tracking and performance monitoring platf…3.7
• CVE-2022-23487js-libp2p is the official javascript Implementation of libp2…7.5
• CVE-2022-23488BigBlueButton is an open source web conferencing system. Ver…7.5
• CVE-2022-2349Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-23490BigBlueButton is an open source web conferencing system. Ver…4.3
• CVE-2022-23491Certifi is a curated collection of Root Certificates for val…7.5
• CVE-2022-23492go-libp2p is the offical libp2p implementation in the Go pro…7.5