PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-34219 libp2p CVE debrief

CVE-2026-34219 is a high-severity vulnerability in the libp2p-rust Gossipsub implementation. Prior to version 0.49.4, a remotely reachable panic occurs in backoff expiry handling. An attacker can send a crafted PRUNE control message with a near-maximum backoff value, causing an overflow and panic when adding duration to instant. This issue is reachable from any Gossipsub peer over normal TCP + Noise + mplex/yamux connectivity and requires no further authentication beyond becoming a protocol peer. The vulnerability has been patched in version 0.49.4. Users of libp2p-rust Gossipsub, especially those with untrusted or internet-facing peers, should upgrade to version 0.49.4 or later to mitigate this vulnerability.

Vendor
libp2p
Product
rust-libp2p
CVSS
HIGH 8.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-31
Original CVE updated
2026-07-24
Advisory published
2026-03-31
Advisory updated
2026-07-24

Who should care

Users of libp2p-rust Gossipsub, especially those with untrusted or internet-facing peers, should upgrade to version 0.49.4 or later to mitigate this vulnerability. This includes operators of nodes in decentralized networks, developers integrating libp2p-rust into their applications, and security teams responsible for monitoring and mitigating vulnerabilities in their infrastructure.

Technical summary

The libp2p-rust Gossipsub implementation contains a remotely reachable panic in backoff expiry handling. A crafted PRUNE control message with an attacker-controlled, near-maximum backoff value can cause an overflow and panic when adding duration to instant. This issue is reachable from any Gossipsub peer over normal TCP + Noise + mplex/yamux connectivity and requires no further authentication beyond becoming a protocol peer. The issue has been patched in version 0.49.4.

Defensive priority

High priority due to high CVSS score and potential for remote exploitation.

Recommended defensive actions

  • Upgrade to libp2p-rust version 0.49.4 or later
  • Review and limit untrusted or internet-facing peers
  • Monitor for suspicious PRUNE control messages
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-03-31T16:16:31.920Z and last modified on 2026-07-24T20:10:00.147Z. The NVD entry is currently Analyzed. Evidence from the CVE record and NVD entry indicates a remotely reachable panic in the libp2p-rust Gossipsub implementation. The issue is caused by a crafted PRUNE control message with an attacker-controlled, near-maximum backoff value. This results in an overflow and panic when adding duration to instant. The issue is reachable from any Gossipsub peer over normal TCP + Noise + mplex/yamux connectivity and requires no further authentication beyond becoming a protocol peer.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-03-31T16:16:31.920Z and has not been modified since then. The NVD entry is currently Analyzed.