CyberRota Analysis
AI-GeneratedThe vulnerability affects the libp2p networking stack in JavaScript, specifically prior to version 4.2.9, where the reservation refresh mechanism improperly handles abort listeners, allowing remote peers to exploit this flaw. This can lead to unbounded listener and closure growth, ultimately resulting in a denial of service for @libp2p/circuit-relay-v2 relay servers. Organizations utilizing affected versions should prioritize upgrading to version 4.2.9 to mitigate potential service disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. As a result, a remote peer can repeatedly send valid RESERVE requests for the same reservation, causing unbounded listener and closure growth in @libp2p/circuit-relay-v2 relay servers and leading to denial of service. This issue is fixed in version 4.2.9.