RUSTSEC-2026-0536

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0536

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0536.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0536

Aliases

CVE-2026-95859
GHSA-g3g5-x568-qvqx

Published

2026-09-05T12:00:00Z

Modified

2026-11-13T12:45:02Z

Summary

Unbounded memory growth from GRAFT messages for unsubscribed topics

Details

When a GRAFT control message arrived, every topic it named was added to that peer's set of topics, on the assumption that a peer grafting us must be subscribed. Nothing checked that the peer had subscribed, and subscription filters only apply to SUBSCRIBE messages. A peer can keep sending GRAFTs with new short topic IDs over one connection, and the set grows until the peer unsubscribes or disconnects. Memory grows without bound and the node can be killed for running out of memory.

The fix no longer records topics from GRAFT messages and drops a GRAFT for a topic the peer has not subscribed to. It also makes MaxCountSubscriptionFilter the default subscription filter. It is in 0.49.5, and was backported to the 0.50 line before 0.50.0.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / libp2p-gossipsub

Package

Name: libp2p-gossipsub; View open source insights on deps.dev
Purl: pkg:cargo/libp2p-gossipsub

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.49.5

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    }
}