CVE-2026-95859— libp2p-rust: Gossipsub GRAFT topics unbounded growth
Quick assessment
Affected
libp2p rust-libp2p
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
libp2p-rust 是 libp2p 网络栈的官方 Rust 语言实现。在 0.49.5 版本之前，Gossipsub 协议在处理 GRAFT 控制消息时，会无条件地将攻击者提供的主题哈希添加到 中，而不会先验证该对等节点是否已订阅这些主题。任何能够访问 Gossipsub 监听器的远程未认证对等节点，均可反复发送新的 GRAFT 主题，导致每个对等节点的内存持续增长；这种增长不受订阅过滤器、对等节点评分机制或单条消息大小限制的约束。该问题可能耗尽进程内存，从而引发拒绝服务（DoS）攻击。此漏洞已在 0.49.
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of ServiceAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| libp2p | rust-libp2p | < 0.49.5 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-95859
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
libp2p-rust: Gossipsub GRAFT topics unbounded growth
Source: CVE Program / CVE List V5
Vulnerability Description
libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.49.5, Gossipsub GRAFT control-message handling unconditionally adds attacker-supplied topic hashes to connected_peer.topics without confirming that the peer previously subscribed to those topics. A remote unauthenticated peer that can reach a Gossipsub listener can repeatedly send novel GRAFT topics, causing cumulative per-peer memory growth that is not bounded by subscription filters, peer scoring, or per-message size limits. This can exhaust process memory and cause a denial of service. This issue is fixed in version 0.49.5.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| libp2p | rust-libp2p | < 0.49.5 | - |
|
II. Public POCs for CVE-2026-95859
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-95859
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-95859 (1)
Vendor Advisories for CVE-2026-95859 (1)
IV. Related Vulnerabilities
Same product: rust-libp2p
-
CVE-2026-61544
libp2p-quic: Remote panic via certificate expiry race during -
CVE-2026-35457
libp2p-rust has unbounded rendezvous DISCOVER cookies enable -
CVE-2026-35405
libp2p-rendezvous: Unlimited namespace registrations per pee -
CVE-2026-34219
libp2p-gossipsub: Gossipsub PRUNE Backoff Heartbeat Instant -
CVE-2026-33040
libp2p-rust: Gossipsub PRUNE.backoff Duration Overflow
Same vendor: libp2p
-
CVE-2026-103936
libp2p: Single pre-auth STUN packet terminates `@libp2p/webr -
CVE-2026-86040
libp2p: Unbounded RPC decode + synchronous subscription proc -
CVE-2026-86039
libp2p: PeerStore accepts attacker-signed PeerRecords for a -
CVE-2026-86038
libp2p: Gossipsub StrictSign accepts attacker-signed message -
CVE-2026-61544
libp2p-quic: Remote panic via certificate expiry race during
Same weakness: CWE-770
-
CVE-2026-110752
Text::CSV_XS versions before 1.65 for Perl allow memory exha -
CVE-2026-85231
Libtirpc: libtirpc: denial of service via unbounded memory a -
CVE-2026-57487
libupnp chunked HTTP bodies can bypass g_maxContentLength an -
CVE-2026-107564
gocsaf/csaf: csaf_provider prone to uncontrolled resource co -
CVE-2026-16251
Mattermost local image proxy allows server memory exhaustion
V. Comments for CVE-2026-95859
No comments yet