Executive brief
A vulnerability in the Rust implementation of the libp2p networking stack allows a remote attacker to crash a target node. By sending a specially crafted message, an attacker can trigger a system failure (panic) during the software's internal heartbeat process. This results in a denial-of-service, potentially disrupting decentralized applications or blockchain nodes that rely on this networking library.
Technical details
The vulnerability exists in the Gossipsub implementation of rust-libp2p due to unchecked arithmetic in the heartbeat expiry logic. An attacker can send a crafted PRUNE control message containing a near-maximum backoff value. While the initial storage of this value uses checked addition, a subsequent heartbeat process performs unchecked 'Instant + Duration' arithmetic (backoff_time + slack). This causes an integer overflow and a process panic. The issue is reachable by any unauthenticated peer over standard TCP + Noise connectivity and has been patched in version 0.49.4.
Affected products
- libp2p rust-libp2p-gossipsub < 0.49.4
Timeline
- 2026-03-27: advisory: GitHub Security Advisory published
- 2026-03-31: disclosed: CVE published to NVD