CVE-2026-86040
Description
A flaw was found in the floodsub component of libp2p. The package accepts unauthenticated Remote Procedure Call (RPC) frames without properly enforcing limits on subscription elements and processes them synchronously. A remote unauthenticated attacker can exploit this vulnerability by sending specially crafted frames containing large volumes of subscription entries. This can lead to excessive CPU and memory consumption, causing the application to crash and resulting in a Denial of Service (DoS).
Statement
Red Hat rates this vulnerability as Important because an unauthenticated remote attacker can trigger complete node unavailability without requiring elevated privileges or user interaction. Network-accessible flaws that permit untrusted actors to block execution threads or exhaust memory resources justify an Important rating due to the severe impact on service availability. In typical Red Hat Enterprise Linux environments, libp2p is not provided as a core system component, restricting potential exposure to custom or third-party Node.js services deployed on the host that process peer-to-peer communications.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
