CVE-2026-95859 libp2p CVE debrief

Who should care

Defenders responsible for libp2p-rust deployments should assess exposure and prioritize updating to version 0.49.5 or later to prevent potential denial of service attacks. This includes reviewing compensating controls, monitoring for potential attacks, and verifying affected versions and scope. Security teams and vulnerability management teams should also review the issue and plan for remediation.

Why it matters

Defenders should care about CVE-2026-95859 because it allows a remote unauthenticated peer to cause a denial of service in libp2p-rust versions prior to 0.49.5, potentially leading to memory exhaustion and impacting availability.

• Denial of service through memory exhaustion
• Potential for cumulative per-peer memory growth
• Need for verification of affected versions and scope

Technical summary

libp2p-rust versions prior to 0.49.5 have a vulnerability in Gossipsub GRAFT control-message handling that allows a remote unauthenticated peer to cause cumulative per-peer memory growth, potentially leading to a denial of service. The issue is fixed in version 0.49.5. Defenders should prioritize updating to version 0.49.5 or later to prevent potential denial of service attacks. The vulnerability can lead to memory exhaustion and impact availability if not addressed promptly. Affected deployments should be identified and updated to prevent exposure.

Defensive priority

Defenders should prioritize updating to version 0.49.5 or later to prevent potential denial of service attacks.

Recommended defensive actions

• Update to version 0.49.5 or later
• Verify affected versions and scope
• Monitor for potential denial of service attacks
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions, retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the issue. Verification from the supplied official sources is required to determine the scope of affected versions and potential impact. The official advisory confirms that the issue is fixed in version 0.49.5. Additional verification tasks are needed to assess exposure and ensure remediation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.