Description
libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.49.5, Gossipsub GRAFT control-message handling unconditionally adds attacker-supplied topic hashes to connected_peer.topics without confirming that the peer previously subscribed to those topics. A remote unauthenticated peer that can reach a Gossipsub listener can repeatedly send novel GRAFT topics, causing cumulative per-peer memory growth that is not bounded by subscription filters, peer scoring, or per-message size limits. This can exhaust process memory and cause a denial of service. This issue is fixed in version 0.49.5.
Published: 2026-10-16
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

The Gossipsub protocol in libp2p‑rust allows any remote peer to send GRAFT control messages that add attacker‑supplied topic hashes without validation. Each message expands the per‑peer topic list unboundedly, eventually exhausting process memory and disabling the node. This flaw is a classic unbounded array length failure under CWE‑770 and manifests as a denial‑of‑service condition.

Affected Systems

All deployments of the libp2p Rust networking stack prior to version 0.49.5 are impacted, specifically the Gossipsub component. Projects exposing a Gossipsub listener to external peers are vulnerable, as the bug causes unrestrained growth of topic lists per connected peer.

Risk and Exploitability

The CVSS score of 8.7 classifies the vulnerability as high severity. No EPSS data is provided and it is not yet listed in CISA's KEV catalog. A remote unauthenticated peer that can reach a Gossipsub listener can repeatedly send novel GRAFT messages, causing memory pressure without any authentication or further privileges. The exploit is straightforward and can lead to immediate service disruption if not mitigated.

Generated by OpenCVE AI on October 16, 2026 at 18:29 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to libp2p‑rust version 0.49.5 or newer to apply the vendor fix.
  • Restrict inbound connections to the Gossipsub listener to trusted peers or a private network to mitigate unauthenticated attackers.
  • Monitor the node’s memory usage and implement automatic restarts or resource limits if memory consumption grows unexpectedly.

Generated by OpenCVE AI on October 16, 2026 at 18:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Description libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.49.5, Gossipsub GRAFT control-message handling unconditionally adds attacker-supplied topic hashes to connected_peer.topics without confirming that the peer previously subscribed to those topics. A remote unauthenticated peer that can reach a Gossipsub listener can repeatedly send novel GRAFT topics, causing cumulative per-peer memory growth that is not bounded by subscription filters, peer scoring, or per-message size limits. This can exhaust process memory and cause a denial of service. This issue is fixed in version 0.49.5.
Title libp2p-rust: Gossipsub GRAFT topics unbounded growth
Weaknesses CWE-770
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-16T15:19:04.504Z

Reserved: 2026-09-22T16:39:45.794Z

Link: CVE-2026-95859

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-16T16:22:44.400

Modified: 2026-10-16T16:22:44.400

Link: CVE-2026-95859

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-16T18:30:14Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling