libp2p rust-libp2p: Denial of service via unbounded Gossipsub GRAFT topics
Summary
The Gossipsub component of libp2p-rust accepts GRAFT control messages for topics a peer never subscribed to and stores them per peer. A remote, unauthenticated peer that can reach a Gossipsub listener can repeatedly send new topic hashes, so memory usage grows without bound and can exhaust the process. Subscription filters, peer scoring and per-message size limits do not limit this growth. Exposure is limited to applications built on rust-libp2p that run a Gossipsub listener, such as P2P or blockchain node software.
Affected
- libp2p-rust versions prior to 0.49.5 (affected crate: libp2p-gossipsub)
- Vendor range per CVE record: rust-libp2p < 0.49.5
- Exact per-crate ranges not confirmed from the advisory itself.
Fixed in
- Upgrade to rust-libp2p 0.49.5 or later (libp2p-gossipsub 0.49.5).
- Fix commit: 51ed5f00e1b0620ded3444ecadf18477052148ea (PR #6608, backport of GHSA-g3g5-x568-qvqx).
Workaround
- No workaround documented by the vendor.
- Restricting which peers can reach gossipsub listeners at network level reduces exposure (own suggestion, not from the vendor).
Exploitation
- CVSS 4.0 base score 8.7 (HIGH), network attack vector, no privileges and no user interaction required.
- CISA SSVC: exploitation none, not automatable.
- No confirmed exploitation or public proof of concept known at the time of research.
- Not listed in the CISA KEV catalog according to one aggregator; verify directly.
Our recommendation
- Check Cargo.lock files for libp2p-gossipsub and rust-libp2p versions below 0.49.5 (cargo audit and cargo deny may not flag this issue).
- Upgrade affected applications to 0.49.5 or later and rebuild them.
- Restrict Gossipsub listener exposure to trusted peers at network level until patched.
- Monitor memory usage of affected nodes for unusual growth.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE commit 51ed5f0 (rust-libp2p) github.com
- Pull Request #6608 (backport) github.com
- GHSA-g3g5-x568-qvqx Security Advisory github.com
- OSV entry CVE-2026-95859 osv.dev
- Tenable CVE-2026-95859 www.tenable.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:16.
Original description (NVD)
libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.49.5, Gossipsub GRAFT control-message handling unconditionally adds attacker-supplied topic hashes to connected_peer.topics without confirming that the peer previously subscribed to those topics. A remote unauthenticated peer that can reach a Gossipsub listener can repeatedly send novel GRAFT topics, causing cumulative per-peer memory growth that is not bounded by subscription filters, peer scoring, or per-message size limits. This can exhaust process memory and cause a denial of service. This issue is fixed in version 0.49.5.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.