CVE-2026-34219 libp2p CVE debrief

Who should care

Users of libp2p-rust Gossipsub, especially those with untrusted or internet-facing peers, should upgrade to version 0.49.4 or later to mitigate this vulnerability. This includes operators of nodes in decentralized networks, developers integrating libp2p-rust into their applications, and security teams responsible for monitoring and mitigating vulnerabilities in their infrastructure.

Technical summary

The libp2p-rust Gossipsub implementation contains a remotely reachable panic in backoff expiry handling. A crafted PRUNE control message with an attacker-controlled, near-maximum backoff value can cause an overflow and panic when adding duration to instant. This issue is reachable from any Gossipsub peer over normal TCP + Noise + mplex/yamux connectivity and requires no further authentication beyond becoming a protocol peer. The issue has been patched in version 0.49.4.

Defensive priority

High priority due to high CVSS score and potential for remote exploitation.

Recommended defensive actions

• Upgrade to libp2p-rust version 0.49.4 or later
• Review and limit untrusted or internet-facing peers
• Monitor for suspicious PRUNE control messages
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-03-31T16:16:31.920Z and last modified on 2026-07-24T20:10:00.147Z. The NVD entry is currently Analyzed. Evidence from the CVE record and NVD entry indicates a remotely reachable panic in the libp2p-rust Gossipsub implementation. The issue is caused by a crafted PRUNE control message with an attacker-controlled, near-maximum backoff value. This results in an overflow and panic when adding duration to instant. The issue is reachable from any Gossipsub peer over normal TCP + Noise + mplex/yamux connectivity and requires no further authentication beyond becoming a protocol peer.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.