Threats affecting pkg:cargo/libp2p/rust-libp2p

CVE-2026-95859 is a high-severity vulnerability in libp2p-rust prior to version 0.49.5. It involves the Gossipsub GRAFT control-message handling, which improperly adds attacker-supplied topic hashes to a peer's topic list without verifying prior subscription. This allows a remote unauthenticated attacker to cause unbounded memory growth per peer, potentially leading to denial of service by exhausting process memory. The issue is fixed in version 0.49.5.

CVE-2026-61544 is a high-severity vulnerability in the rust-libp2p implementation of the libp2p networking stack. Versions prior to 0.13.1 of libp2p-quic can panic during an inbound QUIC handshake if a remote peer presents a valid short-lived TLS certificate that expires before the final TLS 1.3 handshake fragment is received. This causes an uncaught exception due to a repeated certificate validity check, leading to application termination for affected listeners. The issue is fixed in version 0.13.1.

CVE-2026-35457 is a high-severity vulnerability in the rust-libp2p library prior to version 0.17.1. The issue involves the rendezvous server storing pagination cookies without any bounds, allowing an unauthenticated peer to repeatedly send DISCOVER requests and cause unbounded memory growth. This can lead to a denial-of-service condition due to resource exhaustion. The vulnerability is fixed in rust-libp2p version 0.17.1.

libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, libp2p-rendezvous server has no limit on how many namespaces a single peer can register. A malicious peer can just keep registering unique namespaces in a loop and the server happily accepts every single one allocating memory for each registration with no pushback. Keep doing this long enough (or with multiple sybil peers) and the server process gets OOM killed. This vulnerability is fixed in 0.17.1.

libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to version 0.49.4, the Rust libp2p Gossipsub implementation contains a remotely reachable panic in backoff expiry handling. After a peer sends a crafted PRUNE control message with an attacker-controlled, near-maximum backoff value, the value is accepted and stored as an Instant near the representable upper bound. On a later heartbeat, the implementation performs unchecked Instant + Duration arithmetic (backoff_time + slack), which can overflow and panic with: overflow when adding duration to instant. This issue is reachable from any Gossipsub peer over normal TCP + Noise + mplex/yamux connectivity and requires no further authentication beyond becoming a protocol peer. This issue has been patched in version 0.49.4.

libp2p-rust is the official rust language Implementation of the libp2p networking stack. In versions prior to 0.49.3, the Gossipsub implementation accepts attacker-controlled PRUNE backoff values and may perform unchecked time arithmetic when storing backoff state. A specially crafted PRUNE control message with an extremely large backoff (e.g.u64::MAX) can lead to Duration/Instant overflow during backoff update logic, triggering a panic in the networking state machine. This is remotely reachable over a normal libp2p connection and does not require authentication. Any application exposing a libp2p Gossipsub listener and using the affected backoff-handling path can be crashed by a network attacker that can reach the service port. The attack can be repeated by reconnecting and replaying the crafted control message. This issue has been fixed in version 0.49.3.