crates.io/libp2p CVE-2022-23486: high 7.5, EPSS 0.73%

libp2p DoS vulnerability from lack of resource management

Action: Upgrade libp2p to 0.45.1 or later.

cargo update -p libp2p --precise 0.45.1

Affected

Fixed versions

Sources

• osv: GHSA-jvgw-gccv-q5p8
• https://github.com/libp2p/go-libp2p/security/advisories/GHSA-j7qp-mfxf-8xjw
• https://github.com/libp2p/js-libp2p/security/advisories/GHSA-f44q-634c-jvwv
• https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-jvgw-gccv-q5p8
• https://nvd.nist.gov/vuln/detail/CVE-2022-23486
• https://github.com/libp2p/rust-libp2p
• https://rustsec.org/advisories/RUSTSEC-2022-0084.html

CVE-2022-23486 · published 2022-12-07T20:28:46Z · modified 2023-11-08T04:08:18.938960Z · JSON