Yüksek CVSS 7.5
CVE-2026-77384: CVE-2026-77384: denetimsiz kaynak tüketimi
Açıklama (NVD)
libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. As a result, a remote peer can repeatedly send valid RESERVE requests for the same reservation, causing unbounded listener and closure growth in @libp2p/circuit-relay-v2 relay servers and leading to denial of service. This issue is fixed in version 4.2.9.
Özet bilgiler
- CVSS v3.1
- 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - EPSS
- %0,61 (yüzdelik 49)
- CWE
- CWE-400
- Yama
- Yok / bilinmiyor