Reported

October 19, 2026

Issued

November 13, 2026

Package

libp2p-gossipsub (crates.io)

Type

Vulnerability

Categories

• denial-of-service

Keywords

#libp2p #gossipsub #memory-exhaustion

Aliases

• GHSA-vrx6-jcp8-vm7m

References

• https://github.com/libp2p/rust-libp2p/commit/9c647828abea0dfc0b4e827dff1e176ec8b44752
• https://github.com/libp2p/rust-libp2p/pull/6707

Patched

• >=0.50.1

Description

A PRUNE control message names topics and asks for a backoff on each. The handler recorded a backoff for every named topic, including topics the local node had never joined. A peer can send PRUNEs naming many new short topic IDs with a long backoff. Each pair is kept until the backoff expires, up to an hour, even after the peer disconnects, so a stream of PRUNEs, possibly from many peer IDs, can use up the node's memory. Peer scoring does not penalise these messages.

The fix ignores PRUNE entries for topics that are not in the node's mesh. It is in 0.50.1, and was backported to the main branch in libp2p/rust-libp2p#6707.

Advisory available under CC0-1.0 license.