The Gossipsub PRUNE backoff logic in the Rust libp2p implementation accepts attacker‑controlled values and performs unchecked time arithmetic. An attacker can send a PRUNE message with an extraordinarily large backoff, such as u64::MAX, causing a duration/instant overflow that triggers a panic in the networking state machine. The result is an application crash, leading to a denial of service.

Any application that bundles the Rust libp2p library and exposes a Gossipsub listener is affected. The flaw exists in all libp2p‑rust releases prior to version 0.49.3. The issue is specific to the backoff handling path of the Gossipsub protocol stack and can be triggered by any external node communicating over a libp2p connection.

The vulnerability carries a CVSS score of 8.7, indicating high severity, but the EPSS score is below 1 %, suggesting low current exploitation likelihood. It is not listed in the CISA KEV catalog. An attacker only needs to reach the service port; no authentication is required. By sending a crafted PRUNE message, the attacker can repeat the crash by reconnecting and replaying the control message, making the attack repeatable and straightforward once the endpoint is reachable.