Integer overflow in Libp2p Rust-Libp2p
CVE-2026-34219
libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to version 0.49.4, the Rust libp2p Gossipsub implementation contains a remotely reachable panic in backoff expiry handling. After a peer sends a crafted PRUNE control message with an attacker-controlled, near-maximum backoff value, the value is accepted and stored as an Instant near the representable upper bound. On a later heartbeat, the implementation performs unchecked Instant + Duration arithmetic (backoff_time + slack), which can overflow and panic with: overflow when adding duration to instant. This issue is reachable from any Gossipsub peer over normal TCP + Noise + mplex/yamux connectivity and requires no further authentication beyond becoming a protocol peer. This issue has been patched in version 0.49.4.
Vulnerability class: Integer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.005 (40.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 41st percentile — 40.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.005 · change: -0.001
Affected products
- Libp2p Rust-Libp2p — versions < 0.49.4
- Protocol Libp2p-Gossipsub
Weakness classification (CWE)
References
- github.com/libp2p/rust-libp2p/security/advisories/GHSA-xqmp-fxgv-xvq5 (Exploit, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-34219?
- CVE-2026-34219 is a medium-severity vulnerability in Libp2p Rust-Libp2p, classified under Integer Overflow or Wraparound. CVSS score: 5.9/10. Published 2026-03-31.
- How severe is CVE-2026-34219?
- Medium severity. CVSS v3 base score is 5.9 out of 10.