Rust Libp2P
Monthly
Remote unauthenticated denial of service in rust-libp2p Gossipsub affects versions prior to 0.49.5 and allows any peer that can reach a Gossipsub listener to repeatedly send novel GRAFT topic hashes. The handler unconditionally records those attacker-supplied topics in the per-peer connected_peer.topics map, so memory grows cumulatively without being bounded by subscription filters, peer scoring, or per-message size limits, eventually exhausting process memory and taking the node down. No public exploit identified at time of analysis; the issue is availability-only (CVSS 4.0 8.7 / assessed CVSS 3.1 7.5), and reachability of the Gossipsub listener is the practical prerequisite.
Remote unauthenticated denial of service in rust-libp2p Gossipsub affects versions prior to 0.49.5 and allows any peer that can reach a Gossipsub listener to repeatedly send novel GRAFT topic hashes. The handler unconditionally records those attacker-supplied topics in the per-peer connected_peer.topics map, so memory grows cumulatively without being bounded by subscription filters, peer scoring, or per-message size limits, eventually exhausting process memory and taking the node down. No public exploit identified at time of analysis; the issue is availability-only (CVSS 4.0 8.7 / assessed CVSS 3.1 7.5), and reachability of the Gossipsub listener is the practical prerequisite.