P-Shahi

**Name of the Vulnerable Software and Affected Versions** js-libp2p versions prior to v0.38.0 **Description** The issue concerns targeted resource exhaustion attacks that affect libp2p's connection, stream, peer, and memory management. An attacker can cause the allocation of large amounts of memory, leading to the process being killed by the host's operating system. The connection manager in js-libp2p, designed to handle regular peer churn, is not equipped to handle such targeted attacks. **Recommendations** For versions prior to v0.38.0, update the js-libp2p dependency to v0.38.0 or greater. As a temporary mitigation measure, consider using OS tools to block malicious peers or implementing a load balancer in front of libp2p nodes. Additionally, utilize the allow/deny list in js-libp2p to deny specific peers, but note that these measures are no substitute for upgrading js-libp2p.

**Name of the Vulnerable Software and Affected Versions** go-libp2p versions 0.18.0 and older **Description** The issue concerns targeted resource exhaustion attacks that affect libp2p's connection, stream, peer, and memory management. An attacker can cause the allocation of large amounts of memory, ultimately leading to the process getting killed by the host's operating system. While a connection manager is part of go-libp2p to keep connections within manageable limits, it was designed to handle regular peer churn, not targeted resource exhaustion attacks. **Recommendations** To resolve the issue, upgrade go-libp2p to version 0.18.1 or newer. For versions prior to 0.18.1, consider the following: - Update your go-libp2p dependency to go-libp2p v0.18.1 or greater. - Determine appropriate limits for your application, as go-libp2p sets up a resource manager with default limits if none are provided. - Configure your node to be attack resilient by setting up automatic blocking with fail2ban using canonical libp2p log lines. - Consider updating to v0.21.0 or newer for additional functionality that helps in production environments, such as better metrics around resource usage and default autoscaling limits. For users unable to upgrade, consult the denial of service (dos) mitigation page for more information on incorporating mitigation strategies, monitoring your application, and responding to attacks.

**Name of the Vulnerable Software and Affected Versions** libp2p-rust versions prior to 0.45.1 **Description** The issue allows an attacker node to cause a victim node to allocate a large number of small memory chunks, leading to the victim's process running out of memory and potentially getting killed by its operating system. This can result in a denial of service attack, especially when executed against multiple nodes in a libp2p-based network. **Recommendations** For versions prior to 0.45.1, upgrade to libp2p v0.45.1 or above. As a temporary workaround for users unable to upgrade, consider referencing the DoS Mitigation page for more information on how to incorporate mitigation strategies, monitor the application, and respond to attacks.