Remote Panic Vulnerability in libp2p Rust Networking Stack
CVE-2026-34219

8.2HIGH

Key Information:

Vendor

Libp2p

Status
Rust-libp2p
Vendor
CVE Published:
31 March 2026

Badges

📈 Trended📈 Score: 1,550👾 Exploit Exists📰 News Worthy

What is CVE-2026-34219?

CVE-2026-34219 is a vulnerability found in the libp2p networking stack implemented in Rust, specifically prior to version 0.49.4. Libp2p is a modular network stack designed to facilitate peer-to-peer communication across a variety of applications. This vulnerability emerges from the Gossipsub implementation, where handling crafted control messages can trigger a remotely reachable panic due to unchecked arithmetic operations in backoff expiry handling. An attacker can exploit this vulnerability by sending a carefully constructed PRUNE control message containing a near-maximum backoff value, leading to a potential system crash during subsequent operations. The nature of this vulnerability does not necessitate advanced authentication, making it accessible to any peer that becomes part of the protocol network. Organizations leveraging libp2p must be aware that failing to patch this vulnerability could lead to significant disruptions in their peer-to-peer communication framework.

Potential impact of CVE-2026-34219

  1. System Downtime: The exploitation of this vulnerability may result in application crashes, causing downtime for services reliant on the libp2p networking stack. This can disrupt critical operations, leading to loss of availability for applications and services.

  2. Denial of Service: Due to the nature of the remotely reachable panic, an attacker can intentionally trigger the vulnerability to create a denial of service (DoS) condition. This can hinder communication between peers and compromise the reliability of networked applications.

  3. Increased Attack Surface: As this vulnerability is accessible with minimal authentication, it increases the attack surface for threat actors. This could lead to further exploits if the initial panic is used as an entry point for more severe attacks within the affected network infrastructure.

Affected Version(s)

rust-libp2p < 0.49.4

News Articles

favicon imageTechtimes

Ethereum Gossipsub Flaw Lets Any Peer Crash Validators: AI Found It, Humans Confirmed

Ethereum gossipsub vulnerability CVE-2026-34219 lets any unauthenticated peer crash a validator with a single crafted PRUNE message — patch to libp2p-gossipsub v0.49.4 immediately. The Ethereum

favicon imageNewsbreak

Ethereum Node Operators Face Immediate Patch Demand After CVE-2026-34219 Exposes Crash Risk - NewsBreak

A nasty bug. Ethereum’s Protocol Security team found CVE-2026-34219 on July 9, and it’s bad enough that operators running Rust libp2p-gossipsub below v0.49

favicon imageCryptonews

CVE-2026-34219: AI Agents Expose Ethereum Gossipsub Flaw

Ethereum News: A remotely-triggerable panic in libp2p gossipsub lets any peer crash Ethereum nodes. Learn how AI agents found CVE-2026-34219.

References

https://github.com/libp2p/rust-libp2p/security/advisories...
x_refsource_CONFIRM

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 📈

    Vulnerability started trending

  • 👾

    Exploit known to exist

  • 📰

    First article discovered by Cryptonews

  • Vulnerability published

  • Vulnerability Reserved

.