Technical impact
The vulnerability is a remotely reachable panic in the Rust libp2p Gossipsub module caused by an overflow when adding a duration to an instant. When a peer sends a crafted PRUNE control message with a high backoff value, the value is stored near the upper bound and later adds duration during a heartbeat. This unchecked arithmetic can overflow, causing a panic that crashes the node and effectively denies service to the peer and potentially disrupts the network. The flaw is rooted in integer overflow (CWE-190) and unchecked return values (CWE-617).
Affected Systems
The bug affects the libp2p Rust implementation (rust-libp2p) of the Gossipsub protocol, specifically versions prior to 0.49.4. Any node that participates in Gossipsub over normal TCP+Noise+multiplexing (mplex or yamux) is vulnerable, as the flaw is triggered simply by becoming a protocol peer and receiving the malicious PRUNE message.
Risk and Exploitability
The CVSS score of 8.2 indicates a high impact of the crash, while the EPSS score of less than 1% suggests that exploitation is unlikely to be widespread yet. The vulnerability is not listed in the KEV catalog. Attackers can trigger the overflow from any reachable Gossipsub peer without special authentication, making the vector broadly available. Because the effect is a crash rather than data leakage or privilege escalation, the primary risk is denial of service to the targeted node or the network it supports.
Github GHSA