A crafted PRUNE control message can cause a runtime panic in the Rust implementation of libp2p’s Gossipsub protocol. The bug allows an attacker to send a backoff value near the maximum representable instant, which is then stored and later combined with a duration during a heartbeat. Because the addition is unchecked, an overflow occurs and the node panics, taking the node out of service. The flaw is a classic integer overflow (CWE‑190) and improper validation of control data (CWE‑617).

The vulnerability resides in the Rust libp2p library, provided under the libp2p:rust-libp2p product. All releases before version 0.49.4 are affected; the issue was fixed in 0.49.4 and later.

The severity score is 8.2, indicating high severity. The flaw is remotely reachable from any peer that joins the Gossipsub network over standard TCP with Noise and multiplexing using mplex or yamux. No additional authentication or privileged access is required. Exploit probability is not disclosed, and the vulnerability is not documented in major exploit databases.