CVE-2026-95859 in libp2p-rust
Summary
by MITRE • 10/16/2026
libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.49.5, Gossipsub GRAFT control-message handling unconditionally adds attacker-supplied topic hashes to connected_peer.topics without confirming that the peer previously subscribed to those topics. A remote unauthenticated peer that can reach a Gossipsub listener can repeatedly send novel GRAFT topics, causing cumulative per-peer memory growth that is not bounded by subscription filters, peer scoring, or per-message size limits. This can exhaust process memory and cause a denial of service. This issue is fixed in version 0.49.5.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/16/2026
The libp2p-rust library serves as the official Rust implementation of the decentralized networking stack known as libp2p, which facilitates peer-to-peer communication across distributed systems. Within this framework, the Gossipsub protocol is responsible for efficient message dissemination among peers by maintaining topic-based subscriptions and managing connections through specific control messages. A critical vulnerability was identified in versions prior to 0.49.5 regarding the handling of GRAFT control messages. The GRAFT mechanism is designed to allow a peer to request inclusion into a specific topic mesh, thereby enabling it to receive future messages published under that topic. However, the implementation flaw lies in the unconditional addition of attacker-supplied topic hashes to the connected_peer.topics data structure without verifying whether the remote peer had previously issued a SUBSCRIBE message for those topics. This lack of validation bypasses the logical state machine expected by the protocol, allowing any unauthenticated peer with network access to manipulate subscription states arbitrarily.
This technical flaw results in significant operational impact due to cumulative per-peer memory growth that is not bounded by standard mitigation mechanisms such as subscription filters or peer scoring algorithms. Because there are no limits on message size applied during this specific control message processing phase, an attacker can repeatedly send novel GRAFT topics for a target peer. Each invalid graft request adds new entries to the peer's topic list, consuming memory resources that are never reclaimed unless the connection is explicitly closed or reset. This behavior effectively creates a resource exhaustion vector where a remote unauthenticated actor can trigger a denial of service condition by forcing the process to consume excessive amounts of RAM until system stability is compromised or the application crashes due out-of-memory errors.
From a security classification perspective, this vulnerability aligns with CWE-400, which describes Uncontrolled Resource Consumption, as well as CWE-285, Improper Authorization, since the system fails to verify that the peer has authorized access to the requested topics before updating its state. In terms of attack tactics, this behavior is consistent with ATT&CK technique T1496, Resource Hijacking, where an adversary uses a compromised or malicious node to consume resources on target systems, potentially leading to service disruption for legitimate users and other nodes in the network. The absence of proper authorization checks during the GRAFT processing phase allows low-effort exploitation by any entity capable of reaching the Gossipsub listener endpoint.
To mitigate this vulnerability, organizations utilizing libp2p-rust must upgrade immediately to version 0.49.5 or later, where the handling logic has been corrected to validate subscription status before adding topics to a peer's list. Additionally, defensive measures such as implementing strict rate limiting on control messages and enforcing maximum limits on the number of active subscriptions per peer can provide defense-in-depth against similar resource exhaustion attempts. Network-level monitoring should also be employed to detect anomalous patterns of GRAFT requests from single sources, which may indicate an ongoing exploitation attempt targeting older or unpatched instances within a distributed network topology.