CVE-2026-33040

High

Published: 20/03/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

In versions prior to 0.49.3, the Gossipsub implementation in libp2p-rust accepts attacker-controlled PRUNE backoff values, which may lead to time overflow and panic in the networking state machine.

Risk Assessment

An attacker can remotely crash applications using Gossipsub, potentially leading to service downtime.

Recommendation

It is recommended to upgrade to version 0.49.3 or later to mitigate this vulnerability.

Other vulnerabilities in libp2p-rust

CVE-2026-34219Medium
In libp2p-rust before version 0.49.4, the Gossipsub implementation contains a remotely reachable panic in backoff expiry handling. After receiving a crafted PRUNE message with a near-maximum backoff value, the implementation performs unchecked time arithmetic, leading to overflow and panic.

Original NVD description (English source)

libp2p-rust is the official rust language Implementation of the libp2p networking stack. In versions prior to 0.49.3, the Gossipsub implementation accepts attacker-controlled PRUNE backoff values and may perform unchecked time arithmetic when storing backoff state. A specially crafted PRUNE control message with an extremely large backoff (e.g. u64::MAX) can lead to Duration/Instant overflow during backoff update logic, triggering a panic in the networking state machine. This is remotely reachable over a normal libp2p connection and does not require authentication. Any application exposing a libp2p Gossipsub listener and using the affected backoff-handling path can be crashed by a network attacker that can reach the service port. The attack can be repeated by reconnecting and replaying the crafted control message. This issue has been fixed in version 0.49.3.