Denial of Service Vulnerability in libp2p Floodsub Implementation by libp2p

CVE-2026-86040

What is CVE-2026-86040?

The libp2p floodsub implementation is susceptible to a denial of service attack due to inadequate handling of unauthenticated RPC frames. Specifically, before version 11.0.26, it allowed the acceptance of such frames without proper constraints on the number of elements they can contain. An attacker can manipulate this by sending a single, crafted bounded-size frame that decodes into an excessively large number of empty subscription entries, thereby blocking the event loop. This can lead to CPU exhaustion as numerous unique SUBSCRIBE requests generate excessive PeerSet allocations that are not discarded after peer removal. Consequently, the exploitation of this vulnerability can cause significant service interruptions, memory exhaustion, and ultimately result in node unavailability. Mitigation is available in version 11.0.26.

References