Reported

March 18, 2026

Issued

November 13, 2026

Package

libp2p-gossipsub (crates.io)

Type

Vulnerability

Categories

• denial-of-service

Keywords

#libp2p #gossipsub #panic #overflow

Aliases

• CVE-2026-33040
• GHSA-gc42-3jg7-rxr2

References

• https://github.com/libp2p/rust-libp2p/commit/84153a559bdbcb92a48413dd2a31035800cb882d

Patched

• >=0.49.3

Description

When a peer sent a PRUNE control message, the backoff it asked for was turned into an expiry time with Instant::now() + Duration::from_secs(backoff). That addition panics on overflow, so a peer that sends a PRUNE with a very large backoff, such as u64::MAX, crashes the node. No authentication is needed beyond an ordinary libp2p connection with the gossipsub protocol, and the attacker can repeat it after every restart.

The fix uses Instant::checked_add in BackoffStorage::update_backoff and ignores a backoff that would overflow. It is in 0.49.3.

Advisory available under CC0-1.0 license.