Threats affecting pkg:cargo/libp2p-gossipsub

Libp2p gossipsub has a vulnerability where PRUNE control messages cause unbounded backoff state for unknown topics. The node records backoff entries for topics it has never joined, which can accumulate and consume memory for up to an hour, even after peers disconnect. This can be exploited by sending many PRUNE messages with new topic IDs. A fix is available in version 0.50.1.

A vulnerability in libp2p-gossipsub allows unbounded memory growth due to improper handling of GRAFT control messages for topics to which a peer is not subscribed. This can cause a node to run out of memory and be killed. The issue is fixed in version 0.49.5.

A vulnerability in libp2p-gossipsub prior to version 0.49.4 allows a remote peer to cause a panic and crash the node by sending a PRUNE message with a carefully crafted backoff time. The issue arises from unchecked time arithmetic that can overflow during heartbeat processing. The flaw is fixed in version 0.49.4 by capping the backoff time and using checked arithmetic operations.

A vulnerability in libp2p-gossipsub allows a remote peer to crash a node by sending a PRUNE control message with an excessively large backoff value. This triggers a panic due to an overflow when calculating the expiry time. The issue requires no special authentication beyond a normal libp2p connection and can be repeatedly exploited after node restarts. The flaw is fixed in version 0.49.3.