CVE-2026-34219

Name of the Vulnerable Software and Affected Versions libp2p-rust versions prior to 0.49.4

Description The Rust implementation of the libp2p Gossipsub networking stack contains a remotely reachable panic in the backoff expiry handling. An attacker can establish a standard session using TCP, Noise, and a stream multiplexer such as mplex or yamux to send a crafted PRUNE control message. By providing a near-maximum backoff value, the attacker causes the system to store an Instant near its representable upper bound. During a subsequent heartbeat, the implementation performs unchecked arithmetic (backoff time + slack), leading to an overflow and a panic with the message: overflow when adding duration to instant. This allows any unauthenticated protocol peer to trigger a remote denial of service, crashing the target node. This issue was identified by the Ethereum Foundation's security team using AI agents.

Recommendations Update libp2p-rust to version 0.49.4 or later.