VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/libp2p/go-libp2p: vulnerability history, versions and safety

github.com/libp2p/go-libp2p is a package in the Go ecosystem. Vulert records 7 vulnerabilities for it across 120 releases, from Dec 2022 to Sep 2023. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
7 vulnerabilities recorded H3 U4
i
0 with no fix published

Every vulnerability has a patched version to move to.

i
0 in the last 12 months

Nothing new recorded in the last year.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/libp2p/go-libp2p vulnerabilities

Vulert verdict on github.com/libp2p/go-libp2p v0.50.0 i

Updated on 23 Oct 2026

Action needed: v0.50.0 has 7 known vulnerabilities, but every one of them has a fix. Upgrade to the version listed below and you are clear.

Package health score 84/100
  • Security Minor issues
  • Maintenance Sustainable
  • Popularity Key ecosystem project
  • Community Moderate

What to do: Upgrade to the version that resolves each vulnerability below. Fix it, then keep watch: this version is affected today, and the next one may be too — Vulert alerts you when a new vulnerability lands. Monitor it with Vulert →

  • Current release v0.50.0 — affected i
  • Vulnerabilities on record 7 over 1 year · 0 in the last year i
  • Latest disclosure 13 Sep 2023 i
  • Highest CVSS 7.5 i
  • With no published fix 0 i
  • Stars 6,890 i
  • OpenSSF scorecard 5/10 i
  • Last release 1 month ago i
  • Licence MIT i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/libp2p/go-libp2p, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v0.0.0-20261022170529-6b9dd7134a8c 22 Oct 2026 H3 U4 MIT Yes Details →
v0.50.1-0.20261022170529-6b9dd7134a8c 22 Oct 2026 H3 U4 MIT Yes Details →
v0.50.1-0.20261005093136-3a7331e50787 05 Oct 2026 H3 U4 MIT Yes Details →
v0.0.0-20260921141710-3c2c902122cb 21 Sep 2026 H3 U4 MIT Yes Details →
v0.50.0 21 Sep 2026 H3 U4 MIT Yes Details →
v0.0.0-20260919140710-a3dab3e6b8da 19 Sep 2026 H3 U4 MIT Yes Details →
v0.49.1-0.20260919140710-a3dab3e6b8da 19 Sep 2026 H3 U4 MIT Yes Details →
v0.0.0-20260919134229-df7cb35c6dcf 19 Sep 2026 H3 U4 MIT Yes Details →
v0.49.1-0.20260919134229-df7cb35c6dcf 19 Sep 2026 H3 U4 MIT Yes Details →
v0.0.0-20260917134853-ae33383d0641 17 Sep 2026 H3 U4 MIT Yes Details →
v0.49.1-0.20260917134853-ae33383d0641 17 Sep 2026 H3 U4 MIT Yes Details →
v0.48.1-0.20260909103954-528ecd0d780d 09 Sep 2026 H3 U4 MIT Yes Details →
v0.0.0-20260803143114-e20bb60ffc4b 03 Aug 2026 H3 U4 MIT Yes Details →
v0.49.1-0.20260803143114-e20bb60ffc4b 03 Aug 2026 H3 U4 MIT Yes Details →
v0.0.0-20260729152550-726accf4a1aa 29 Jul 2026 H3 U4 MIT Yes Details →
v0.49.1-0.20260729152550-726accf4a1aa 29 Jul 2026 H3 U4 MIT Yes Details →
v0.0.0-20260728080307-5c7e6ecb92be 28 Jul 2026 H3 U4 MIT Yes Details →
v0.49.0 28 Jul 2026 H3 U4 MIT Yes Details →
v0.0.0-20260727192033-07d71d869571 27 Jul 2026 H3 U4 MIT Yes Details →
v0.48.1-0.20260727192033-07d71d869571 27 Jul 2026 H3 U4 MIT Yes Details →
v0.48.1-0.20260727171827-ba6ff9cd2dc3 27 Jul 2026 H3 U4 MIT Yes Details →
v0.0.0-20260727122002-bb0dc7d0335d 27 Jul 2026 H3 U4 MIT Yes Details →
v0.48.1-0.20260727122002-bb0dc7d0335d 27 Jul 2026 H3 U4 MIT Yes Details →
v0.0.0-20260722165246-0d90292576f8 22 Jul 2026 H3 U4 MIT Yes Details →
v0.48.1-0.20260722165246-0d90292576f8 22 Jul 2026 H3 U4 MIT Yes Details →
v0.48.1-0.20260715204039-42aa212c5646 15 Jul 2026 H3 U4 MIT Yes Details →
v0.0.0-20260709142922-ec408fcc60c9 09 Jul 2026 H3 U4 MIT Yes Details →
v0.48.1-0.20260709142922-ec408fcc60c9 09 Jul 2026 H3 U4 MIT Yes Details →
v0.0.0-20260708062241-95be6665b014 08 Jul 2026 H3 U4 MIT Yes Details →
v0.48.1-0.20260708062241-95be6665b014 08 Jul 2026 H3 U4 MIT Yes Details →
v0.0.0-20260701080947-d09490038637 01 Jul 2026 H3 U4 MIT Yes Details →
v0.48.1-0.20260701080947-d09490038637 01 Jul 2026 H3 U4 MIT Yes Details →
v0.0.0-20260630074020-a0932209fc38 30 Jun 2026 H3 U4 MIT Yes Details →
v0.48.1-0.20260630074020-a0932209fc38 30 Jun 2026 H3 U4 MIT Yes Details →
v0.0.0-20260608164629-8f1ddf32f7f4 08 Jun 2026 H3 U4 MIT Yes Details →
v0.48.1-0.20260608164629-8f1ddf32f7f4 08 Jun 2026 H3 U4 MIT Yes Details →
v0.0.0-20260603104142-e6309a296286 03 Jun 2026 H3 U4 MIT Yes Details →
v0.48.1-0.20260603104142-e6309a296286 03 Jun 2026 H3 U4 MIT Yes Details →
v0.0.0-20260603041141-0608272b6b52 03 Jun 2026 H3 U4 MIT Yes Details →
v0.48.1-0.20260603041141-0608272b6b52 03 Jun 2026 H3 U4 MIT Yes Details →
v0.48.1-0.20260602173923-bb289fcf25f2 02 Jun 2026 H3 U4 MIT Yes Details →
v0.0.0-20260520074050-6a6b1ffd8a9a 20 May 2026 H3 U4 MIT Yes Details →
v0.48.1-0.20260520074050-6a6b1ffd8a9a 20 May 2026 H3 U4 MIT Yes Details →
v0.48.1-0.20260515215300-a72c0588b088 15 May 2026 H3 U4 MIT Yes Details →
v0.0.0-20260513144927-3bfc5492c5b7 13 May 2026 H3 U4 MIT Yes Details →
v0.48.1-0.20260513144927-3bfc5492c5b7 13 May 2026 H3 U4 MIT Yes Details →
v0.0.0-20260511210612-cc27c1d83020 11 May 2026 H3 U4 MIT Yes Details →
v0.48.1-0.20260511210612-cc27c1d83020 11 May 2026 H3 U4 MIT Yes Details →
v0.0.0-20260511194948-9180aa004a0b 11 May 2026 H3 U4 MIT Yes Details →
v0.48.1-0.20260511194948-9180aa004a0b 11 May 2026 H3 U4 MIT Yes Details →
v0.0.0-20260511183707-8f3cb82f8fac 11 May 2026 H3 U4 MIT Yes Details →
v0.48.1-0.20260511183707-8f3cb82f8fac 11 May 2026 H3 U4 MIT Yes Details →
v0.0.0-20260510154137-ffca823dd5c6 10 May 2026 H3 U4 MIT Yes Details →
v0.48.1-0.20260510154137-ffca823dd5c6 10 May 2026 H3 U4 MIT Yes Details →
v0.0.0-20260506200836-e97dab891e13 06 May 2026 H3 U4 MIT Yes Details →
v0.48.1-0.20260506200836-e97dab891e13 06 May 2026 H3 U4 MIT Yes Details →
v0.0.0-20260501155304-9cfe2cc00be5 01 May 2026 H3 U4 MIT Yes Details →
v0.48.1-0.20260501155304-9cfe2cc00be5 01 May 2026 H3 U4 MIT Yes Details →
v0.0.0-20260428205138-e5b7bf00c166 28 Apr 2026 H3 U4 MIT Yes Details →
v0.48.1-0.20260428205138-e5b7bf00c166 28 Apr 2026 H3 U4 MIT Yes Details →
v0.0.0-20260423232830-2f158627d859 23 Apr 2026 H3 U4 MIT Yes Details →
v0.48.1-0.20260423232830-2f158627d859 23 Apr 2026 H3 U4 MIT Yes Details →
v0.0.0-20260422035249-41462353c6e7 22 Apr 2026 H3 U4 MIT Yes Details →
v0.48.1-0.20260422035249-41462353c6e7 22 Apr 2026 H3 U4 MIT Yes Details →
v0.0.0-20260330223723-65729455502b 30 Mar 2026 H3 U4 MIT Yes Details →
v0.48.1-0.20260330223723-65729455502b 30 Mar 2026 H3 U4 MIT Yes Details →
v0.0.0-20260317215846-062200be7aa1 17 Mar 2026 H3 U4 MIT Yes Details →
v0.48.0 17 Mar 2026 H3 U4 MIT Yes Details →
v0.0.0-20260317213327-061805d8769d 17 Mar 2026 H3 U4 MIT Yes Details →
v0.47.1-0.20260317213327-061805d8769d 17 Mar 2026 H3 U4 MIT Yes Details →
v0.0.0-20260317190633-418cf8ff40bf 17 Mar 2026 H3 U4 MIT Yes Details →
v0.0.0-20260316194958-93a9158968c0 16 Mar 2026 H3 U4 MIT Yes Details →
v0.47.1-0.20260316194958-93a9158968c0 16 Mar 2026 H3 U4 MIT Yes Details →
v0.0.0-20260316124121-7d0752e7df1d 16 Mar 2026 H3 U4 MIT Yes Details →
v0.47.1-0.20260316124121-7d0752e7df1d 16 Mar 2026 H3 U4 MIT Yes Details →
v0.0.0-20260305172004-67f4f585fbdb 05 Mar 2026 H3 U4 MIT Yes Details →
v0.47.1-0.20260305172004-67f4f585fbdb 05 Mar 2026 H3 U4 MIT Yes Details →
v0.0.0-20260227105549-7198ad347f79 27 Feb 2026 H3 U4 MIT Yes Details →
v0.47.1-0.20260227105549-7198ad347f79 27 Feb 2026 H3 U4 MIT Yes Details →
v0.0.0-20260226224050-e16f35e99a91 26 Feb 2026 H3 U4 MIT Yes Details →
v0.47.1-0.20260226224050-e16f35e99a91 26 Feb 2026 H3 U4 MIT Yes Details →
v0.0.0-20260217200923-8a6fd5b92346 17 Feb 2026 H3 U4 MIT Yes Details →
v0.47.1-0.20260217200923-8a6fd5b92346 17 Feb 2026 H3 U4 MIT Yes Details →
v0.0.0-20260202112555-026bdce7d5b3 02 Feb 2026 H3 U4 MIT Yes Details →
v0.47.1-0.20260202112555-026bdce7d5b3 02 Feb 2026 H3 U4 MIT Yes Details →
v0.0.0-20260129213519-7f5ce40aaa03 29 Jan 2026 H3 U4 MIT Yes Details →
v0.47.1-0.20260129213519-7f5ce40aaa03 29 Jan 2026 H3 U4 MIT Yes Details →
v0.0.0-20260126222251-46986fcdbf65 26 Jan 2026 H3 U4 MIT Yes Details →
v0.47.1-0.20260126222251-46986fcdbf65 26 Jan 2026 H3 U4 MIT Yes Details →
v0.0.0-20260125145539-b93eda0937a5 25 Jan 2026 H3 U4 MIT Yes Details →
v0.47.0 25 Jan 2026 H3 U4 MIT Yes Details →
v0.0.0-20260122212528-12393541b665 22 Jan 2026 H3 U4 MIT Yes Details →
v0.46.1-0.20260122212528-12393541b665 22 Jan 2026 H3 U4 MIT Yes Details →
v0.0.0-20260122192808-dd26469c52a7 22 Jan 2026 H3 U4 MIT Yes Details →
v0.46.1-0.20260122192808-dd26469c52a7 22 Jan 2026 H3 U4 MIT Yes Details →
v0.0.0-20260108190511-636d44e15abc 08 Jan 2026 H3 U4 MIT Yes Details →
v0.46.1-0.20260108190511-636d44e15abc 08 Jan 2026 H3 U4 MIT Yes Details →
v0.0.0-20260108011116-479b24baab77 08 Jan 2026 H3 U4 MIT Yes Details →
v0.46.1-0.20260108011116-479b24baab77 08 Jan 2026 H3 U4 MIT Yes Details →
v0.0.0-20260107192511-6c4273f47ed1 07 Jan 2026 H3 U4 MIT Yes Details →
v0.46.1-0.20260107192511-6c4273f47ed1 07 Jan 2026 H3 U4 — Yes Details →
v0.0.0-20260105233223-b0b2a1847d8f 05 Jan 2026 H3 U4 — Yes Details →
v0.46.1-0.20260105233223-b0b2a1847d8f 05 Jan 2026 H3 U4 — Yes Details →
v0.0.0-20251213094315-20ba3c944980 13 Dec 2025 H3 U4 — Yes Details →
v0.46.0 13 Dec 2025 H3 U4 — Yes Details →
v0.0.0-20251211200621-f96852745c72 11 Dec 2025 H3 U4 — Yes Details →
v0.45.1-0.20251211200621-f96852745c72 11 Dec 2025 H3 U4 — Yes Details →
v0.0.0-20251202032553-cf61065945d9 02 Dec 2025 H3 U4 — Yes Details →
v0.45.1-0.20251202032553-cf61065945d9 02 Dec 2025 H3 U4 — Yes Details →
v0.45.1-0.20251118033727-4dc576a5076f 18 Nov 2025 H3 U4 — Yes Details →
v0.0.0-20251113190846-aefe38980c39 13 Nov 2025 H3 U4 — Yes Details →
v0.45.1-0.20251113190846-aefe38980c39 13 Nov 2025 H3 U4 — Yes Details →
v0.0.0-20251111230116-5d5f8d745522 11 Nov 2025 H3 U4 — Yes Details →
v0.45.1-0.20251111230116-5d5f8d745522 11 Nov 2025 H3 U4 — Yes Details →
v0.45.1-0.20251108160658-80dcb4ca6afe 08 Nov 2025 H3 U4 — Yes Details →
v0.45.1-0.20251108155711-130df55e9db2 08 Nov 2025 H3 U4 — Yes Details →
v0.0.0-20251106040550-d0ecbf99a977 06 Nov 2025 H3 U4 — Yes Details →
v0.45.0 06 Nov 2025 H3 U4 — Yes Details →
v0.44.1-0.20251104204556-3b3b1fd6e00e 04 Nov 2025 H3 U4 — Yes Details →
v0.0.0-20251104204133-3f09fa4244a4 04 Nov 2025 H3 U4 — Yes Details →

The newest 120 of 2,291 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2022 3
  • 2023 4

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 0 of the 7 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/libp2p/go-libp2p

The 5 most severe of 7 vulnerabilities recorded for this package

Search all 7 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2023-39533: libp2p nodes vulnerable to attack using large RSA keys 7.5 high 0.27.8 09 Aug 2023
CVE-2023-40583: libp2p nodes vulnerable to OOM attack 7.5 high 0.27.4 24 Aug 2023
CVE-2022-23492: libp2p DoS vulnerability in go-libp2p 7.5 high 0.18.0 07 Dec 2022
CVE-2022-23492: libp2p DoS vulnerability in go-libp2p N/A unrated 0.18.0 14 Dec 2022
CVE-2022-23492: Resource Exhaustion in go-libp2p N/A unrated 0.18.0 14 Dec 2022

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/libp2p/go-libp2p

Is github.com/libp2p/go-libp2p safe to use?

Vulert records 7 vulnerabilities for github.com/libp2p/go-libp2p in Go: 0 critical, 3 high, 0 medium and 0 low, plus 4 not yet rated. Every one of them has a published fix, so the practical answer is to run a supported release and keep it patched.

What is github.com/libp2p/go-libp2p's Vulert package health score?

Vulert scores github.com/libp2p/go-libp2p 84/100, which reads as in good shape. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Is the latest version of github.com/libp2p/go-libp2p affected?

Yes. v0.50.0, the version you would install today, has 7 known vulnerabilities, and every one of them has a published fix. Upgrade to the version listed for each.

Which version of github.com/libp2p/go-libp2p should I use?

v0.50.0 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/libp2p/go-libp2p have?

7 vulnerabilities are recorded for github.com/libp2p/go-libp2p in the Go ecosystem: 0 critical, 3 high, 0 medium and 0 low, plus 4 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/libp2p/go-libp2p vulnerabilities disclosed?

0 vulnerabilities were recorded for github.com/libp2p/go-libp2p in the last 12 months, and the oldest entry in this database dates to 07 Dec 2022. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/libp2p/go-libp2p are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/libp2p/go-libp2p for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/libp2p/go-libp2p version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.