rust-libp2p Gossipsub EUVD-2026-102898

The target node must be running the libp2p-rust Gossipsub protocol (protocols/gossipsub) at a version prior to 0.49.5 and expose a Gossipsub listener reachable by the attacker; no authentication, user interaction, or non-default configuration is required, since the vulnerable GRAFT handling is part of default control-message processing. The specific prerequisite is reachability of a Gossipsub-enabled endpoint - a node that does not run Gossipsub or is not network-reachable by the attacker is not affected. The only practical limiting factor is network exposure of the Gossipsub listener; subscription filters, peer scoring, and per-message size limits do NOT constrain the growth and therefore provide no mitigation.

This is a genuine, actionable availability risk rather than an inflated high-score issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) is fully consistent with the description: a remote, unauthenticated peer that can reach a Gossipsub listener can trigger the flaw with no special timing or preconditions (AC:L, AT:N), and impact is availability-only (VA:H, VC:N/VI:N) - matching CWE-770 uncontrolled resource consumption leading to memory exhaustion and denial of service. All signals agree on scope: there is no confidentiality or integrity impact and no scope change to subsequent systems, so the 8.7 score is driven entirely by the ease and reliability of the DoS, which is appropriate. No EPSS score, no CISA KEV listing, and no public exploit are present in the input, so exploitation probability cannot be quantified; however, the fixing PR diff (libp2p/rust-libp2p#6608) publicly documents the exact unbounded-growth logic in connected_peer.topics, which materially lowers the effort to reproduce even though it is not itself weaponized exploit code. Net: treat as a real patching priority for any node exposing a Gossipsub listener, but note the impact ceiling is service disruption, not compromise.

A remote unauthenticated peer connects to a node running libp2p-rust Gossipsub (version < 0.49.5) and repeatedly sends GRAFT control messages each referencing novel, never-subscribed topic hashes. Because the handler inserts every attacker-supplied topic into the per-peer connected_peer.topics set without verifying prior subscription, and this growth is bounded by neither subscription filters, peer scoring, nor per-message size limits, sustained GRAFT flooding drives cumulative per-peer memory growth until the process exhausts memory and crashes. No public exploit is identified at time of analysis, though the fixing PR publicly describes the vulnerable code path.