CVE-2026-33040 Details
Description
libp2p-rust is the official rust language Implementation of the libp2p networking stack. In versions prior to 0.49.3, the Gossipsub implementation accepts attacker-controlled PRUNE backoff values and may perform unchecked time arithmetic when storing backoff state. A specially crafted PRUNE control message with an extremely large backoff (e.g. u64::MAX) can lead to Duration/Instant overflow during backoff update logic, triggering a panic in the networking state machine. This is remotely reachable over a normal libp2p connection and does not require authentication. Any application exposing a libp2p Gossipsub listener and using the affected backoff-handling path can be crashed by a network attacker that can reach the service port. The attack can be repeated by reconnecting and replaying the crafted control message. This issue has been fixed in version 0.49.3.
A denial-of-service vulnerability has been identified in the libp2p Rust implementation, specifically within the Gossipsub messaging protocol, in versions prior to 0.49.3. The issue arises because the Gossipsub implementation accepts PRUNE control messages with attacker-controlled backoff values. This can lead to unchecked time arithmetic, causing overflow errors when the backoff value is excessively large, such as u64::MAX. When this overflow occurs, it triggers a panic in the networking state machine, crashing the application. The vulnerability can be exploited remotely over a standard libp2p connection, without the need for authentication, by sending a single crafted PRUNE message with a large backoff value. This issue has been patched in version 0.49.3.
Users are advised to upgrade to libp2p Rust version 0.49.3 or later, which includes a fix for this vulnerability by improving the handling of Gossipsub backoff values.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-gc42-3jg7-rxr2 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-190 | Integer Overflow or Wraparound | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| protocol libp2p-gossipsub | < 0.49.3 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 1, 2026 | Reanalysis | [email protected] |
| Apr 30, 2026 | Reanalysis | [email protected] |
| Mar 23, 2026 | Initial Analysis | [email protected] |
| Mar 20, 2026 | New CVE Received | [email protected] |