CVE-2023-36325

Low severity, CVSS 3.7. EPSS: 0.5% chance of exploitation in the next 30 days.

i2p before 2.3.0 (Java) allows de-anonymizing the public IPv4 and IPv6 addresses of i2p hidden services (aka eepsites) via a correlation attack across the IPv4 and IPv6 addresses that occurs when a tunneled, replayed message has a behavior discrepancy (it may be dropped, or may result in a Wrong Destination response). An attack would take days to complete.

Published 2024-10-09. Last modified 2026-06-17.