PT-2026-29063

Name of the Vulnerable Software and Affected Versions libp2p-rust versions prior to 0.49.4 Description The libp2p-rust Gossipsub implementation has a flaw where a crafted PRUNE control message with a near-maximum backoff value can cause a panic due to unchecked Instant + Duration arithmetic durin...

CVE-2026-33040

The CVE concerns libp2p-rust Gossipsub: prior to version 0.49.3, the Gossipsub backoff handling accepts attacker-controlled PRUNE backoff values, enabling unchecked time arithmetic that can overflow when updating backoff state. A crafted PRUNE message with a very large backoff (e.g., u64::MAX) ca...

PT-2026-26181

Name of the Vulnerable Software and Affected Versions libp2p-rust versions prior to 0.49.3 Description The libp2p-rust Gossipsub implementation is susceptible to a remote, unauthenticated denial-of-service condition. The implementation accepts attacker-controlled PRUNE backoff values and performs...