CVE-2026-34219: libp2p rust-libp2p Integer Overflow or Wraparound

Vulnerability summary

CVE-2026-34219 is a high (CVSS 8.2) Integer Overflow or Wraparound vulnerability in libp2p rust-libp2p. EPSS estimates a 0.50% chance of exploitation in the next 30 days, higher than 41.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 31-03-2026
   PublishedVulnerability first disclosed.
2. 31-03-2026
   Last modifiedVulnerability information updated.

Description

libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to version 0.49.4, the Rust libp2p Gossipsub implementation contains a remotely reachable panic in backoff expiry handling. After a peer sends a crafted PRUNE control message with an attacker-controlled, near-maximum backoff value, the value is accepted and stored as an Instant near the representable upper bound. On a later heartbeat, the implementation performs unchecked Instant + Duration arithmetic (backoff_time + slack), which can overflow and panic with: overflow when adding duration to instant. This issue is reachable from any Gossipsub peer over normal TCP + Noise + mplex/yamux connectivity and requires no further authentication beyond becoming a protocol peer. This issue has been patched in version 0.49.4.

• CWE-190Integer Overflow or WraparoundThe product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
• CWE-617Reachable AssertionThe product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.