CVE-2026-95859 Details

A denial-of-service vulnerability has been identified in the libp2p Rust implementation of the Gossipsub protocol, prior to version 0.49.5. The issue arises because the GRAFT control message handling adds topic hashes supplied by remote peers to the recipient's topic list without verifying if the peer had previously subscribed to those topics. This flaw allows an unauthenticated peer to send new GRAFT topics repeatedly, causing unbounded memory growth per peer, which can exhaust process memory and disrupt service. The vulnerability is present in any application that exposes a libp2p Gossipsub listener and can be exploited by a network attacker who can reach the service port.

Users should upgrade to libp2p Gossipsub version 0.49.5 or later, which addresses the vulnerability by removing the unconditional insertion of GRAFT topics into the per-peer topic set without verification. The patched version also changes the default topic subscription filter to limit the number of subscribed topics, preventing unbounded growth from GRAFT messages.