Unchecked Time Arithmetic Vulnerability in libp2p Networking Stack by libp2p-rust

CVE-2026-33040

What is CVE-2026-33040?

The libp2p-rust library's Gossipsub implementation has a security flaw that allows an attacker to manipulate PRUNE backoff values, potentially causing overflow issues in Duration/Instant calculations. This can occur when a crafted PRUNE control message with an excessively large backoff value (like u64::MAX) is sent. The vulnerability enables a remote attacker to crash applications exposing Gossipsub listeners without requiring authentication, by exploiting the flawed backoff update logic. The issue has been fixed in version 0.49.3.

References