CVE-2026-95859
HighCVSS 8.7Summary
In libp2p-rust, Gossipsub GRAFT control-message handling unconditionally adds attacker-supplied topic hashes to connected_peer.topics without confirming prior subscription. A remote unauthenticated peer can repeatedly send novel GRAFT topics, causing cumulative per-peer memory growth that can exhaust process memory and cause denial of service.
Risk Assessment
An attacker can exhaust process memory, causing denial of service in the libp2p network. The risk includes unavailability of Gossipsub-based services.
Recommendation
Update libp2p-rust to version 0.49.5 or later. Consider restricting access to Gossipsub listeners and monitoring memory usage.
Other vulnerabilities in libp2p-rust
See all- CVE-2026-33040High
In versions prior to 0.49.3, the Gossipsub implementation in libp2p-rust accepts attacker-controlled PRUNE backoff values, which may lead to time overflow and panic in the networking state machine.
- CVE-2026-61544High
In libp2p-rust, libp2p-quic could panic during an inbound QUIC handshake when a remote peer presented a valid short-lived libp2p TLS certificate and delayed the final TLS 1.3 handshake fragment until after the certificate expired. In the Quinn post-handshake upgrade path, the code called libp2p_tls::certificate::parse a second time and used expect on the result; the repeated wall-clock validity check could reject the now-expired certificate, causing the expect call to terminate any application exposing an affected libp2p-quic listener. Fixed in 0.13.1.
- CVE-2026-34219Medium
In libp2p-rust before version 0.49.4, the Gossipsub implementation contains a remotely reachable panic in backoff expiry handling. After receiving a crafted PRUNE message with a near-maximum backoff value, the implementation performs unchecked time arithmetic, leading to overflow and panic.
Original NVD description (English source)
libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.49.5, Gossipsub GRAFT control-message handling unconditionally adds attacker-supplied topic hashes to connected_peer.topics without confirming that the peer previously subscribed to those topics. A remote unauthenticated peer that can reach a Gossipsub listener can repeatedly send novel GRAFT topics, causing cumulative per-peer memory growth that is not bounded by subscription filters, peer scoring, or per-message size limits. This can exhaust process memory and cause a denial of service. This issue is fixed in version 0.49.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS