{"id":"GHSA-gc42-3jg7-rxr2","summary":"Gossipsub PRUNE.backoff Duration Overflow","details":"### Summary\nThe Rust libp2p Gossipsub implementation accepts attacker-controlled PRUNE backoff values and may perform unchecked time arithmetic when storing backoff state.\nA specially crafted PRUNE control message with an extremely large backoff (e.g. u64::MAX) can lead to Duration/Instant overflow during backoff update logic, triggering a panic in the networking state machine. This is remotely reachable over a normal libp2p connection and does not require authentication.\n\n### Attack Scenario\nAn attacker that can establish a libp2p Gossipsub session with a target node can crash the target by sending a single crafted PRUNE control message:\n1. Establish a standard libp2p transport session and negotiate a stream multiplexer.\n2. Open a Gossipsub stream and negotiate the meshsub protocol.\n3. Send one protobuf RPC containing ControlPrune with a very large backoff value (e.g. 18446744073709551615 / u64::MAX).\nWhen processed, the oversized backoff can reach time-update logic that adds Duration::from_secs(backoff) to Instant::now(), causing overflow and panic.\n\n### Impact\nRemote unauthenticated denial of service.\nAny application exposing a libp2p Gossipsub listener and using the affected backoff-handling path can be crashed by a network attacker that can reach the service port. The attack can be repeated by reconnecting and replaying the crafted control message.\n### Patches\nUsers should upgrade to a release that hardens Gossipsub backoff handling.\n\nThis vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program","aliases":["CVE-2026-33040"],"modified":"2026-03-20T21:34:48.742824Z","published":"2026-03-18T19:54:12Z","database_specific":{"github_reviewed_at":"2026-03-18T19:54:12Z","nvd_published_at":"2026-03-20T06:16:12Z","cwe_ids":["CWE-190"],"severity":"HIGH","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-gc42-3jg7-rxr2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33040"},{"type":"PACKAGE","url":"https://github.com/libp2p/rust-libp2p"}],"affected":[{"package":{"name":"libp2p-gossipsub","ecosystem":"crates.io","purl":"pkg:cargo/libp2p-gossipsub"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.49.3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-gc42-3jg7-rxr2/GHSA-gc42-3jg7-rxr2.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}