CVE-2026-34219 libp2p-gossipsub: Gossipsub PRUNE Backoff Heartbeat Instant Overflow

What is CVE-2026-34219?

CVE-2026-34219 is a high-severity vulnerability in rust-libp2p, published on 31 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to version 0.49.4, the Rust libp2p Gossipsub implementation contains a remotely reachable panic in backoff expiry handling. After a peer sends a crafted PRUNE control message with an attacker-controlled, near-maximum backoff value, the value is accepted and stored as an Instant near the representable upper bound. On a later heartbeat, the implementation performs unchecked Instant + Duration arithmetic (backoff_time + slack), which can overflow and panic with: overflow when adding duration to instant. This issue is reachable from any Gossipsub peer over normal TCP + Noise + mplex/yamux connectivity and requires no further authentication beyond becoming a protocol peer. This issue has been patched in version 0.49.4.

Weakness: CWE-617, CWE-190

Which versions are affected by CVE-2026-34219?

2 open source packages ship an affected version, including libp2p-gossipsub. It affects 1 product.

Products include Protocol Libp2p-Gossipsub.

How do I fix CVE-2026-34219?

Upgrade libp2p-gossipsub to 0.49.4 or later.

Is CVE-2026-34219 being exploited?

There is no known exploitation of CVE-2026-34219 in the wild and no public exploit code.

Other vulnerabilities in rust-libp2p

• CVE-2026-33040 libp2p-rust: Gossipsub PRUNE.backoff Duration Overflow High 8.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xqmp-fxgv-xvq5.