PT-2026-26181 · Unknown · Libp2P-Rust
Revofusion
·
Published
2026-03-18
·
Updated
2026-05-01
·
CVE-2026-33040
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
libp2p-rust versions prior to 0.49.3
Description
The libp2p-rust Gossipsub implementation is susceptible to a remote, unauthenticated denial-of-service condition. The implementation accepts attacker-controlled PRUNE backoff values and performs unchecked time arithmetic when storing backoff state. A specially crafted PRUNE control message with an extremely large backoff value, such as
u64::MAX, can cause a Duration/Instant overflow during backoff update logic, triggering a panic in the networking state machine. This can be exploited by an attacker establishing a libp2p Gossipsub session with a target node by sending a single crafted PRUNE control message. The attack can be repeated by reconnecting and replaying the crafted control message. The API Endpoint involved is the Gossipsub stream. The vulnerable parameter is the backoff value within the ControlPrune protobuf RPC.Recommendations
Upgrade to version 0.49.3 or later.
Fix
Integer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Libp2P-Rust