CVE-2025-29606: py-libp2p DOS Vulnerability

CVE-2025-29606 Overview

CVE-2025-29606 is a denial of service vulnerability affecting py-libp2p versions before 0.2.3. A remote peer can trigger excessive resource consumption by submitting a large RSA key during peer negotiation. The flaw is classified under CWE-770: Allocation of Resources Without Limits or Throttling.

py-libp2p is the Python implementation of the libp2p peer-to-peer networking stack used in decentralized applications. Because peer key exchange occurs before any authentication decision, attackers can abuse the endpoint without valid credentials on the target network.

Critical Impact
A network-adjacent peer can exhaust CPU or memory resources on any py-libp2p node by supplying an oversized RSA key, degrading availability of the affected service.

Affected Products

py-libp2p versions prior to 0.2.3
Python applications embedding py-libp2p for peer-to-peer networking
Decentralized services built on the libp2p Python stack

Discovery Timeline

2025-07-14 - CVE-2025-29606 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-29606

Vulnerability Analysis

The vulnerability resides in how py-libp2p processes RSA public keys exchanged with remote peers. The library accepts RSA keys without enforcing an upper bound on key size. Parsing and validating an arbitrarily large key requires significant CPU time and memory allocation, since RSA operations scale with key length.

An attacker connects to a py-libp2p node and presents an RSA key of excessive bit length during the identity or handshake phase. The receiving node attempts to decode, validate, and store the key, consuming resources proportional to the attacker-controlled size. Repeated connections amplify the effect and can render the node unresponsive.

The issue impacts availability only. It does not expose confidential data or allow modification of state, which aligns with the C:N/I:N/A:L impact profile in the vulnerability metadata.

Root Cause

The root cause is missing input validation on the size of RSA keys accepted from remote peers. Cryptographic key handling code paths trusted peer-supplied length parameters and performed expensive operations without first rejecting values outside a sane range.

Attack Vector

Exploitation requires network access to a py-libp2p endpoint and the ability to initiate a peer connection. The attacker crafts an RSA key with an unusually large modulus and submits it during peer identification. See the GitHub Issue #526 Discussion and Pull Request #531 Changes for the technical reproduction and remediation details.

Detection Methods for CVE-2025-29606

Indicators of Compromise

Sustained high CPU or memory utilization on py-libp2p processes without corresponding legitimate traffic volume
Repeated inbound peer connections from a single source followed by handshake errors or timeouts
Handshake or identity protocol logs referencing RSA keys with unusually large modulus sizes

Detection Strategies

Instrument the peer handshake layer to log the bit length of incoming RSA keys and alert on values exceeding 4096 bits
Track process-level CPU and memory deltas correlated with new inbound libp2p sessions
Monitor for repeated connection attempts from the same peer identifier that fail during key validation

Monitoring Recommendations

Forward py-libp2p application logs and host telemetry to a centralized analytics platform for correlation
Baseline normal handshake duration and flag outliers indicating expensive cryptographic parsing
Alert on py-libp2p worker processes reaching configured memory or CPU thresholds

How to Mitigate CVE-2025-29606

Immediate Actions Required

Upgrade py-libp2p to version 0.2.3 or later across all deployments
Inventory Python applications and dependencies to identify embedded py-libp2p usage
Rate-limit and firewall inbound peer connections at the network layer where feasible

Patch Information

The fix is included in py-libp2p 0.2.3. Review the GitHub Release Notes v0.2.3 for the full change set and the Pull Request #531 Changes for the specific key-size validation logic added to the handshake path.

Workarounds

Restrict inbound peer connectivity to trusted peer identifiers using allowlists
Deploy connection rate limiting and per-source concurrency caps in front of py-libp2p endpoints
Enforce process-level resource limits (for example, cgroups memory and CPU quotas) to contain abuse until patching is complete

bash

# Upgrade py-libp2p to the fixed release
pip install --upgrade 'py-libp2p>=0.2.3'

# Verify installed version
python -c "import libp2p; print(libp2p.__version__)"