PT-2026-29063 · Unknown · Libp2P-Rust

Published 2026-03-30 · Updated 2026-05-01 · CVE-2026-34219

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions libp2p-rust versions prior to 0.49.4

Description The libp2p-rust Gossipsub implementation has a flaw where a crafted PRUNE control message with a near-maximum backoff value can cause a panic due to unchecked Instant + Duration arithmetic during backoff expiry handling. This occurs when the backoff time and slack are added together, leading to an overflow. The issue is reachable from any Gossipsub peer using standard TCP + Noise + mplex/yamux connectivity and requires no authentication beyond establishing a protocol peer connection. An attacker can exploit this by sending a crafted PRUNE control message containing a large backoff value. The value is initially stored using checked addition, but the subsequent unchecked addition during heartbeat processing causes the overflow and panic. This results in a remote, unauthenticated denial of service. The vulnerability is distinct from CVE-2026-33040, which addressed a different overflow during backoff insertion.

Recommendations Versions prior to 0.49.4 should be updated to version 0.49.4 or later.

Fix

Integer Overflow

Assertion Failure

Weakness Enumeration

CWE-190

CWE-617

Related Identifiers

CVE-2026-34219

GHSA-XQMP-FXGV-XVQ5

Affected Products

Libp2P-Rust

References · 6

• https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-xqmp-fxgv-xvq5 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xqmp-fxgv-xvq5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34219 · Security Note
• https://github.com/libp2p/rust-libp2p · Note
• https://github.com/advisories/GHSA-gc42-3jg7-rxr2 · Note
• https://t.me/cveNotify/161800 · Telegram Post