Reported

March 27, 2026

Issued

November 13, 2026

Package

libp2p-gossipsub (crates.io)

Type

Vulnerability

Categories

• denial-of-service

Keywords

#libp2p #gossipsub #panic #overflow

Aliases

• CVE-2026-34219
• GHSA-xqmp-fxgv-xvq5

References

• https://github.com/libp2p/rust-libp2p/commit/55e4a64630f66d55fec5955c8f9905413c5d0859

Patched

• >=0.49.4

Description

The 0.49.3 fix stopped an overflow when a PRUNE backoff is first stored, but a backoff just small enough to be stored could still overflow later. On each heartbeat, expired backoffs were found with backoff_time + slack > now, which panics when the stored time is close to the largest Instant. A peer that sends one PRUNE with such a backoff crashes the node a heartbeat or so later, and can repeat it after every restart.

The fix caps a remote PRUNE backoff at one hour, uses checked_add for the heartbeat comparison, and replaces other unchecked time arithmetic in the behaviour, peer scoring and time cache with checked or saturating operations. It is in 0.49.4.

Advisory available under CC0-1.0 license.