Remote Panic Vulnerability in libp2p Rust Networking Stack
CVE-2026-34219

8.2HIGH

Key Information:

Vendor

Libp2p

Status
Rust-libp2p
Vendor
CVE Published:
31 March 2026

What is CVE-2026-34219?

The libp2p-rust networking stack, specifically its Gossipsub implementation, has a vulnerability that allows remote attackers to trigger a panic condition. This occurs when a peer sends a specially crafted PRUNE control message containing an attacker-controlled backoff value. If the value near the upper limit is accepted, unchecked arithmetic operations during a heartbeat can lead to an overflow, causing the implementation to panic. This issue can be exploited by any peer in the Gossipsub network through standard TCP connections, requiring no additional authentication. It has been addressed in version 0.49.4.

Affected Version(s)

rust-libp2p < 0.49.4

References

https://github.com/libp2p/rust-libp2p/security/advisories...
x_refsource_CONFIRM

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.