Integer overflow in Libp2p Rust-Libp2p
CVE-2026-33040
libp2p-rust is the official rust language Implementation of the libp2p networking stack. In versions prior to 0.49.3, the Gossipsub implementation accepts attacker-controlled PRUNE backoff values and may perform unchecked time arithmetic when storing backoff state. A specially crafted PRUNE control message with an extremely large backoff (e.g. u64::MAX) can lead to Duration/Instant overflow during backoff update logic, triggering a panic in the networking state machine. This is remotely reachable over a normal libp2p connection and does not require authentication. Any application exposing a libp2p Gossipsub listener and using the affected backoff-handling path can be crashed by a network attacker that can reach the service port. The attack can be repeated by reconnecting and replaying the crafted control message. This issue has been fixed in version 0.49.3.
Vulnerability class: Integer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.005 (43.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 43rd percentile — 43.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.005 · change: -0.000
Affected products
- Libp2p Rust-Libp2p — versions < 0.49.3
- Protocol Libp2p-Gossipsub
Weakness classification (CWE)
References
- github.com/libp2p/rust-libp2p/security/advisories/GHSA-gc42-3jg7-rxr2 (Vendor Advisory)
Frequently asked questions
- What is CVE-2026-33040?
- CVE-2026-33040 is a high-severity vulnerability in Libp2p Rust-Libp2p, classified under Integer Overflow or Wraparound. CVSS score: 7.5/10. Published 2026-03-20.
- How severe is CVE-2026-33040?
- High severity. CVSS v3 base score is 7.5 out of 10.