libp2p Rust Memory Exhaustion Flaw Threatens Network Stability
A high-severity flaw in libp2p-rust allows remote peers to exhaust memory via unbounded topic handling. Version 0.49.5 patches the issue.
Key points
- CVE-2026-95859 carries a CVSS score of 8.7, rated as HIGH severity.
- The vulnerability affects libp2p-rust versions prior to 0.49.5.
- Attackers can trigger denial of service by sending GRAFT messages.
The official Rust implementation of the libp2p networking stack contains a high-severity memory management flaw. Versions of the software prior to 0.49.5 are vulnerable to a denial-of-service attack that can exhaust process memory. This issue stems from how the Gossipsub protocol handles control messages from remote peers.
How it unfolded
- The vulnerability exists in the GRAFT control-message handling logic within the libp2p-rust library.
- The code unconditionally adds attacker-supplied topic hashes to the connected peer's topic list.
- This addition occurs without verifying that the peer previously subscribed to those specific topics.
Who is affected
Any system running libp2p-rust versions older than 0.49.5 is exposed to this risk. The flaw allows a remote, unauthenticated peer to repeatedly send novel GRAFT topics to a listener. According to the National Vulnerability Database, this behavior causes cumulative per-peer memory growth. This growth is not bounded by subscription filters, peer scoring mechanisms, or per-message size limits.
Our take on the response
The vendor has released version 0.49.5, which fixes this specific issue. The patch addresses the unconditional addition of topic hashes that previously led to unbounded memory consumption. That suggests the fix restores proper validation checks for peer subscriptions. Teams should verify their current library versions immediately to determine if they fall below the 0.49.5 threshold.
Who needs to act first
Managed service providers should prioritize systems with direct internet exposure. Identify nodes running libp2p-rust versions below 0.49.5. Test the updated version in a non-production environment first. Back up configuration files before applying the patch. Roll out the fix to critical infrastructure first. Monitor memory usage during the update. Ensure logging remains active to detect any residual anomalies. Do not disable network controls while waiting for the patch.
What to do and how to stay safe: libp2p
- Audit all servers and containers for installations of libp2p-rust older than version 0.49.5.
- Apply the 0.49.5 update to affected systems as soon as testing confirms stability.
- Monitor system memory usage for unusual spikes that indicate ongoing exploitation attempts.
- Review firewall rules to restrict access to Gossipsub listeners from untrusted networks.
Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-95859?
The CVSS score is 8.7, which is rated as HIGH severity.
Which versions of libp2p-rust are vulnerable?
All versions of libp2p-rust prior to 0.49.5 are affected by this vulnerability.
Is there a fix available for this issue?
Yes, the issue is fixed in version 0.49.5 of the libp2p-rust library.
