discord/libdave vulnerabilities

CVEs whose affected-version data names the discord/libdave package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-104480Critical· 9.4

today

Improper MLS Welcome roster validation in Discord libdave allows unauthorized group membership

Discord libdave before 1.2.0 did not reject an MLS Welcome message when the resulting group roster contained an unrecognized participant. An attacker in control of the DAVE signaling path (the voice gateway, or an equivalent position abl…

▾ MidnightDiscord · discord/libdavevia CVEORG