{"id":"CVE-2026-33040","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-33040","summary":"Gossipsub PRUNE.backoff Duration Overflow","details":"### Summary\nThe Rust libp2p Gossipsub implementation accepts attacker-controlled PRUNE backoff values and may perform unchecked time arithmetic when storing backoff state.\nA specially crafted PRUNE control message with an extremely large backoff (e.g. u64::MAX) can lead to Duration/Instant overflow during backoff update logic, triggering a panic in the networking state machine. This is remotely reachable over a normal libp2p connection and does not require authentication.\n\n### Attack Scenario\nAn attacker that can establish a libp2p Gossipsub session with a target node can crash the target by sending a single crafted PRUNE control message:\n1. Establish a standard libp2p transport session and negotiate a stream multiplexer.\n2. Open a Gossipsub stream and negotiate the meshsub protocol.\n3. Send one protobuf RPC containing ControlPrune with a very large backoff value (e.g. 18446744073709551615 / u64::MAX).\nWhen processed, the oversized backoff can reach time-update logic that adds Duration::from_secs(backoff) to Instant::now(), causing overflow and panic.\n\n### Impact\nRemote unauthenticated denial of service.\nAny application exposing a libp2p Gossipsub listener and using the affected backoff-handling path can be crashed by a network attacker that can reach the service port. The attack can be repeated by reconnecting and replaying the crafted control message.\n### Patches\nUsers should upgrade to a release that hardens Gossipsub backoff handling.\n\nThis vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program","published":"2026-03-18T19:54:12Z","modified":"2026-03-20T21:34:48.742824Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"libp2p-gossipsub","fixedVersion":"0.49.3"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-gc42-3jg7-rxr2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33040"},{"type":"PACKAGE","url":"https://github.com/libp2p/rust-libp2p"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-03-20T21:34:48.742824Z"}}