libp2p py-libp2p vulnerabilities

Latest libp2p py-libp2p CVEs

Newest publication first

1. CVE-2026-73568 py-libp2p: yamux connection DoS via oversized data frame

   Published 2026-08-13

   High·CVSS 7.5 EPSS 0.49%

   py-libp2p is the Python implementation of the libp2p networking stack. In 0.7.0 and earlier, the yamux handle_incoming() method in libp2p/stream_muxer/yamux/yamux.py reads an attacker-controlled 32-bit DATA frame length with read_exactly() before validating it against MAX_WINDOW_...

2. CVE-2025-29606 py-libp2p is vulnerable to DoS attacks through use of large RSA keys

   Published 2025-07-14

   Medium·CVSS 4.3 EPSS 0.38%

   py-libp2p before 0.2.3 allows a peer to cause a denial of service (resource consumption) via a large RSA key.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.