RUSTSEC-2026-0534

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0534

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0534.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0534

Aliases

GHSA-vrx6-jcp8-vm7m

Published

2026-10-19T12:00:00Z

Modified

2026-11-13T12:45:07Z

Summary

Unbounded backoff state from PRUNE messages for unknown topics

Details

A PRUNE control message names topics and asks for a backoff on each. The handler recorded a backoff for every named topic, including topics the local node had never joined. A peer can send PRUNEs naming many new short topic IDs with a long backoff. Each pair is kept until the backoff expires, up to an hour, even after the peer disconnects, so a stream of PRUNEs, possibly from many peer IDs, can use up the node's memory. Peer scoring does not penalise these messages.

The fix ignores PRUNE entries for topics that are not in the node's mesh. It is in 0.50.1, and was backported to the main branch in libp2p/rust-libp2p#6707.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / libp2p-gossipsub

Package

Name: libp2p-gossipsub; View open source insights on deps.dev
Purl: pkg:cargo/libp2p-gossipsub

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.50.1

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    }
}