Libp2p gossipsub: Unbounded backoff state from PRUNE messages for unknown topics
Affects libp2p-gossipsubSource GCVE Database
Rated Medium by Threat Radar's AI analysis
- Patch
- Available – fixed in 0.50.1
Data as of 13 Nov 2026, 13:17 UTC
What to do
Upgrade libp2p-gossipsub to 0.50.1.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
crates.iolibp2p-gossipsubpkg:cargo/libp2p-gossipsubOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade libp2p-gossipsub to version 0.50.1 or later, which includes the fix that ignores PRUNE entries for topics not in the node's mesh. This prevents unbounded memory consumption from unknown topic backoff entries. No other mitigation is required as the fix addresses the root cause.
Description
Libp2p gossipsub has a vulnerability where PRUNE control messages cause unbounded backoff state for unknown topics. The node records backoff entries for topics it has never joined, which can accumulate and consume memory for up to an hour, even after peers disconnect. This can be exploited by sending many PRUNE messages with new topic IDs. A fix is available in version 0.50.1.