Vendor
Protocol
24 known vulnerabilities in products by Protocol, 0 of them actively exploited (CISA KEV).
Key figures
24
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2020-12821 | Protocol Gossipsub: security vulnerability | 9.8 | |
| High | CVE-2020-26279 | Path traversal | 7.7 | |
| High | CVE-2022-23495 | ProtoNode may be modified such that common method calls may panic in ipfs/go-merkledag | 7.5 | |
| High | CVE-2020-35909 | Protocol Multihash: security vulnerability | 7.5 | |
| High | CVE-2020-26283 | Control character injection in console output | 6.8 | |
| High | CVE-2026-33040 | libp2p-rust: Gossipsub PRUNE.backoff Duration Overflow | 7.5 | |
| High | CVE-2026-34219 | libp2p-gossipsub: Gossipsub PRUNE Backoff Heartbeat Instant Overflow | 5.9 | |
| High | CVE-2023-22460 | go-ipld-prime json codec may panic if asked to encode bytes | 7.5 | |
| High | CVE-2020-10937 | Protocol Ipfs: security vulnerability | 7.5 | |
| High | CVE-2022-23492 | go-libp2p denial of service vulnerability from lack of resource management | 7.5 | |
| High | CVE-2026-31814 | Yamux remote Panic via malformed WindowUpdate credit | 7.5 | |
| High | CVE-2026-32314 | Yamux remote Panic via malformed Data frame with SYN set and len = 262145 | 7.5 | |
| High | CVE-2023-25568 | Boxo bitswap/server: DOS unbounded persistent memory leak | 8.2 | |
| High | CVE-2023-40583 | libp2p nodes vulnerable to OOM attack | 7.5 | |
| High | CVE-2022-2584 | Panic when decoding invalid blocks in github.com/ipld/go-codec-dagpb | 7.5 | |
| High | CVE-2022-23486 | libp2p-rust denial of service vulnerability from lack of resource management | 7.5 | |
| High | CVE-2022-23487 | libp2p denial of service vulnerability from lack of resource management | 7.5 | |
| High | CVE-2026-35405 | libp2p-rendezvous: Unlimited namespace registrations per peer enables OOM DoS on rendezvous servers | 7.5 | |
| High | CVE-2023-23626 | Denial of service when feeding malformed size arguments in go-bitfield | 5.9 | |
| High | CVE-2026-35457 | libp2p-rust has unbounded rendezvous DISCOVER cookies enable remote memory exhaustion | 8.2 | |
| High | CVE-2023-23631 | HAMT Decoding Panics in github.com/ipfs/go-unixfsnode | 5.9 | |
| High | CVE-2023-23625 | Denial of service in HAMT Decoding in go-unixfs | 5.9 | |
| Medium | CVE-2026-35480 | go-ipld-prime's DAG-CBOR decoder unbounded memory allocation from CBOR headers | 6.2 | |
| Medium | CVE-2022-47547 | Protocol Gossipsub: security vulnerability | 5.3 |
Products
| Libp2p | 6 | 0 |