CVE-2026-95859
Received Received - Intake

Memory Exhaustion in libp2p-rust Gossipsub

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description
libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.49.5, Gossipsub GRAFT control-message handling unconditionally adds attacker-supplied topic hashes to connected_peer.topics without confirming that the peer previously subscribed to those topics. A remote unauthenticated peer that can reach a Gossipsub listener can repeatedly send novel GRAFT topics, causing cumulative per-peer memory growth that is not bounded by subscription filters, peer scoring, or per-message size limits. This can exhaust process memory and cause a denial of service. This issue is fixed in version 0.49.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-95859
EUVD
EUVD-2026-102898

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
libp2p rust-libp2p < 0.49.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the libp2p-rust library, specifically its Gossipsub implementation. Prior to version 0.49.5, the system unconditionally adds attacker-supplied topic hashes to a peer's topic list without verifying prior subscription. An unauthenticated remote peer can repeatedly send new GRAFT topics, causing unbounded memory growth in the victim's process. This leads to memory exhaustion and denial of service.

Detection Guidance

Monitor memory usage of libp2p processes for abnormal growth. Check for repeated GRAFT control messages with unique topic hashes in network traffic logs. Use tools like netstat or ss to inspect active connections to libp2p ports. Verify the libp2p version is 0.49.5 or higher to confirm patch status.

Impact Analysis

If you run a vulnerable version of libp2p-rust (before 0.49.5), an attacker could exploit this to crash your application by consuming all available memory. The attack requires only network access and no special privileges. Repeated exploitation could disrupt services relying on libp2p for peer-to-peer communication.

Compliance Impact

This vulnerability primarily causes a denial-of-service condition by exhausting system memory through unbounded topic hash storage. It does not directly impact data confidentiality or integrity, which are key focus areas for GDPR and HIPAA. However, prolonged denial-of-service could disrupt services handling personal or health data, potentially leading to compliance issues related to availability requirements in these regulations.

Mitigation Strategies

Upgrade libp2p-rust to version 0.49.5 or later. Implement network-level restrictions to limit connections from untrusted peers. Monitor for signs of memory exhaustion and terminate suspicious connections. Apply subscription limits if not already configured.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-95859. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart