CVE-2026-33040
HIGH
GHSA-gc42-3jg7-rxr2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessEstablish libp2p Gossipsub connection
-
DeliveryCraft PRUNE message with u64::MAX backoff
-
ExploitTrigger Duration/Instant overflow
-
ExecutionPanic networking state machine
-
ImpactCrash target node
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Remote unauthenticated attacker establishing libp2p Gossipsub session with target node running Rust libp2p. Attacker sends crafted PRUNE control message with extremely large backoff value (e.g., u64::MAX). No victim interaction required. Affects default Gossipsub configurations. |
| Impact | This vulnerability presents a significant real-world risk despite the absence of traditional CVSS scoring. The attack vector is network-based with no authentication required and minimal attack complexity—a single malformed message triggers the crash. The detailed proof-of-concept published in the GitHub security advisory (GHSA-gc42-3jg7-rxr2) provides step-by-step instructions for exploitation, significantly lowering the barrier to weaponization. The impact is limited to availability (denial of service via panic), but the attack is repeatable and automatable, allowing persistent disruption of affected services. Given the widespread use of libp2p in critical blockchain infrastructure (Ethereum consensus clients) and decentralized storage systems (IPFS), the blast radius could be substantial. While no EPSS score or KEV listing is available, the combination of proof-of-concept availability, zero authentication requirements, and critical infrastructure deployment makes this a genuine operational priority for organizations running libp2p Gossipsub services. Under SSVC framework, this rates high for exploitation potential (POC public) and technical impact (service crash). |
| Exploit ScenarioDerived | An attacker identifies an Ethereum consensus client or IPFS node running vulnerable libp2p-gossipsub by scanning for exposed libp2p ports. The attacker establishes a standard libp2p connection, negotiates the Gossipsub protocol stream, and sends a single crafted protobuf RPC message containing a ControlPrune with backoff set to u64::MAX (18446744073709551615). The target node's Gossipsub implementation attempts to add this massive duration to the current time instant, triggering an integer overflow panic that crashes the networking stack and takes the node offline. The attacker can repeat this attack immediately upon reconnection to maintain persistent denial of service. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 18, 2026
The Rust libp2p Gossipsub implementation contains an integer overflow vulnerability that allows remote unauthenticated attackers to crash affected nodes by sending a single crafted PRUNE control message with an extremely large backoff value (e.g., u64::MAX). The vulnerability affects the libp2p-gossipsub Rust crate and enables trivial denial of service against any application exposing a Gossipsub listener. This vulnerability was discovered through responsible disclosure to the Ethereum Foundation bug bounty program by @revofusion, and while no active exploitation (KEV) status is indicated, the attack complexity is extremely low and a detailed proof-of-concept attack scenario has been publicly disclosed in the advisory.
RemediationAI
Users of libp2p-gossipsub should immediately upgrade to a patched release that includes hardened Gossipsub backoff handling, as recommended in the GitHub security advisory at https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-gc42-3jg7-rxr2. Consult the libp2p Rust project release notes and the advisory for specific version numbers containing the fix. Until patching is possible, organizations can temporarily mitigate risk by implementing network-level controls such as restricting Gossipsub listener access to trusted peer networks only, deploying connection rate limiting to slow repeated attack attempts, or running affected services behind firewalls that filter connections to known-good peers. Given the low attack complexity and availability of a detailed exploit scenario, patching should be prioritized over workarounds for production systems.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in cargo
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Rust implementation of libp2p Gossipsub (pkg:rust/libp2p-gossipsub), a pub-sub messaging protocol commonly used in peer-to-peer networks including Ethereum and IPFS infrastructure. The root cause is classified as CWE-190 (Integer Overflow or Wraparound). The vulnerability exists in the backoff handling logic where the implementation accepts attacker-controlled backoff values from PRUNE control messages without proper validation. When an extremely large backoff value is processed, the code performs unchecked arithmetic by adding Duration::from_secs(backoff) to Instant::now(), causing a panic due to Duration or Instant overflow in Rust's time handling primitives. The libp2p protocol stack uses a stream multiplexer over standard transports, and Gossipsub operates as a protocol-negotiated stream within that framework, making this reachable through normal network connections without authentication requirements.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Summary
The Rust libp2p Gossipsub implementation accepts attacker-controlled PRUNE backoff values and may perform unchecked time arithmetic when storing backoff state. A specially crafted PRUNE control message with an extremely large backoff (e.g. u64::MAX) can lead to Duration/Instant overflow during backoff update logic, triggering a panic in the networking state machine. This is remotely reachable over a normal libp2p connection and does not require authentication.
Attack Scenario
An attacker that can establish a libp2p Gossipsub session with a target node can crash the target by sending a single crafted PRUNE control message:
- Establish a standard libp2p transport session and negotiate a stream multiplexer.
- Open a Gossipsub stream and negotiate the meshsub protocol.
- Send one protobuf RPC containing ControlPrune with a very large backoff value (e.g. 18446744073709551615 / u64::MAX).
When processed, the oversized backoff can reach time-update logic that adds Duration::from_secs(backoff) to Instant::now(), causing overflow and panic.
Impact
Remote unauthenticated denial of service. Any application exposing a libp2p Gossipsub listener and using the affected backoff-handling path can be crashed by a network attacker that can reach the service port. The attack can be repeated by reconnecting and replaying the crafted control message.
Patches
Users should upgrade to a release that hardens Gossipsub backoff handling.
This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program
Executive ViewAI
A critical vulnerability in the Rust libp2p Gossipsub networking library allows attackers to crash applications with a single malicious message, potentially disrupting any service using this component for peer-to-peer communication. Organizations running blockchain nodes, distributed applications, or services built on libp2p face immediate denial-of-service risk until patches are available.
Network segmentation to restrict Gossipsub listener access to known, trusted peers only; firewall rules to rate-limit or block inbound Gossipsub protocol messages from untrusted sources; disable Gossipsub functionality if not operationally required; implement traffic monitoring and alerting on PRUNE message patterns; consider running affected services behind load balancers or API gateways that can absorb or filter malformed messages; maintain up-to-date monitoring for patch release from the libp2p maintainers.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB