CVE-2026-77384

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-77384", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-20T19:36:13.806Z", "datePublished": "2026-08-24T21:06:39.909Z", "dateUpdated": "2026-08-25T19:04:25.322Z"}, "containers": {"cna": {"title": "libp2p: Circuit relay v2 server reservation refresh leaks abort listeners and allows remote resource exhaustion", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-772", "lang": "en", "description": "CWE-772: Missing Release of Resource after Effective Lifetime", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/libp2p/js-libp2p/security/advisories/GHSA-x787-gh7p-hmq7", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/libp2p/js-libp2p/security/advisories/GHSA-x787-gh7p-hmq7"}, {"name": "https://github.com/libp2p/js-libp2p/commit/4bb8fbe8d3f3590e4af51a1f5f7de56fffa5804d", "tags": ["x_refsource_MISC"], "url": "https://github.com/libp2p/js-libp2p/commit/4bb8fbe8d3f3590e4af51a1f5f7de56fffa5804d"}, {"name": "https://github.com/libp2p/js-libp2p/releases/tag/circuit-relay-v2-v4.2.9", "tags": ["x_refsource_MISC"], "url": "https://github.com/libp2p/js-libp2p/releases/tag/circuit-relay-v2-v4.2.9"}], "affected": [{"vendor": "libp2p", "product": "js-libp2p", "versions": [{"version": ">= 2.1.5, < 4.2.9", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-24T21:06:39.909Z"}, "descriptions": [{"lang": "en", "value": "libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. As a result, a remote peer can repeatedly send valid RESERVE requests for the same reservation, causing unbounded listener and closure growth in @libp2p/circuit-relay-v2 relay servers and leading to denial of service. This issue is fixed in version 4.2.9."}], "source": {"advisory": "GHSA-x787-gh7p-hmq7", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/libp2p/js-libp2p/security/advisories/GHSA-x787-gh7p-hmq7", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-25T19:03:46.256710Z", "id": "CVE-2026-77384", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T19:04:25.322Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-77384", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T19:03:46.256710Z"}}}], "references": [{"url": "https://github.com/libp2p/js-libp2p/security/advisories/GHSA-x787-gh7p-hmq7", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T19:04:20.929Z"}}], "cna": {"title": "libp2p: Circuit relay v2 server reservation refresh leaks abort listeners and allows remote resource exhaustion", "source": {"advisory": "GHSA-x787-gh7p-hmq7", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "libp2p", "product": "js-libp2p", "versions": [{"status": "affected", "version": ">= 2.1.5, < 4.2.9"}]}], "references": [{"url": "https://github.com/libp2p/js-libp2p/security/advisories/GHSA-x787-gh7p-hmq7", "name": "https://github.com/libp2p/js-libp2p/security/advisories/GHSA-x787-gh7p-hmq7", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/libp2p/js-libp2p/commit/4bb8fbe8d3f3590e4af51a1f5f7de56fffa5804d", "name": "https://github.com/libp2p/js-libp2p/commit/4bb8fbe8d3f3590e4af51a1f5f7de56fffa5804d", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/libp2p/js-libp2p/releases/tag/circuit-relay-v2-v4.2.9", "name": "https://github.com/libp2p/js-libp2p/releases/tag/circuit-relay-v2-v4.2.9", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. As a result, a remote peer can repeatedly send valid RESERVE requests for the same reservation, causing unbounded listener and closure growth in @libp2p/circuit-relay-v2 relay servers and leading to denial of service. This issue is fixed in version 4.2.9."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-772", "description": "CWE-772: Missing Release of Resource after Effective Lifetime"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-24T21:06:39.909Z"}}}, "cveMetadata": {"cveId": "CVE-2026-77384", "state": "PUBLISHED", "dateUpdated": "2026-08-25T19:04:25.322Z", "dateReserved": "2026-08-20T19:36:13.806Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-24T21:06:39.909Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "js-libp2p", "vendor": "libp2p", "versions": [{"status": "affected", "version": ">= 2.1.5, < 4.2.9"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. As a result, a remote peer can repeatedly send valid RESERVE requests for the same reservation, causing unbounded listener and closure growth in @libp2p/circuit-relay-v2 relay servers and leading to denial of service. This issue is fixed in version 4.2.9."}, {"lang": "es", "value": "libp2p es una implementaci\u00f3n JavaScript de la pila de red libp2p. Antes de la versi\u00f3n 4.2.9, la ruta de actualizaci\u00f3n de reserva en reservation-store.ts reutiliza la misma retimeableSignal pero registra incondicionalmente otro oyente de aborto en cada actualizaci\u00f3n. Como resultado, un par remoto puede enviar repetidamente solicitudes RESERVE v\u00e1lidas para la misma reserva, causando un crecimiento ilimitado de oyentes y cierres en los servidores de retransmisi\u00f3n @libp2p/circuit-relay-v2 y llevando a una denegaci\u00f3n de servicio. Este problema se corrige en la versi\u00f3n 4.2.9."}], "id": "CVE-2026-77384", "lastModified": "2026-10-12T15:10:00.207", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77384", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-25T19:03:46.256710Z", "version": "2.0.3"}}]}, "published": "2026-08-24T22:17:19.650", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/libp2p/js-libp2p/commit/4bb8fbe8d3f3590e4af51a1f5f7de56fffa5804d"}, {"source": "security-advisories@github.com", "url": "https://github.com/libp2p/js-libp2p/releases/tag/circuit-relay-v2-v4.2.9"}, {"source": "security-advisories@github.com", "url": "https://github.com/libp2p/js-libp2p/security/advisories/GHSA-x787-gh7p-hmq7"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/libp2p/js-libp2p/security/advisories/GHSA-x787-gh7p-hmq7"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-772"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2026-08-24T23:00:06.205998+00:00", "updated": "2026-08-24T23:00:06.206003+00:00", "vendors": []}