CVE-2026-34219

libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to version 0.49.4, the Rust libp2p Gossipsub implementation contains a remotely reachable panic in backoff expiry handling. After a peer sends a crafted PRUNE control message with an attacker-controlled, near-maximum backoff value, the value is accepted and stored as an Instant near the representable upper bound. On a later heartbeat, the implementation performs unchecked Instant + Duration arithmetic (backoff_time + slack), which can overflow and panic with: overflow when adding duration to instant. This issue is reachable from any Gossipsub peer over normal TCP + Noise + mplex/yamux connectivity and requires no further authentication beyond becoming a protocol peer. This issue has been patched in version 0.49.4.

• CWE-190
• CWE-617

• https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-xqmp-fxgv-xvq5Exploit, Vendor Advisory

Published

Mar 31, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34213Docmost is open-source collaborative wiki and documentation …5.4
• CVE-2026-34214Trino is a distributed SQL query engine for big data analyti…6.5
• CVE-2026-34215Parse Server is an open source backend that can be deployed …6.5
• CVE-2026-34216CtrlPanel is open-source billing software for hosting provid…6.6
• CVE-2026-34217SandboxJS is a JavaScript sandboxing library. Prior to 0.8.3…7.2
• CVE-2026-34218ClearanceKit intercepts file-system access events on macOS a…6.3
• CVE-2026-3422U-Office Force developed by e-Excellence has a Insecure Dese…9.8
• CVE-2026-34220MikroORM is a TypeScript ORM for Node.js based on Data Mappe…9.8
• CVE-2026-34221MikroORM is a TypeScript ORM for Node.js based on Data Mappe…9.1
• CVE-2026-34222Open WebUI is a self-hosted artificial intelligence platform…7.7
• CVE-2026-34223A vulnerability has been identified in Desigo CC ClickOnce C…8.2
• CVE-2026-34224Parse Server is an open source backend that can be deployed …4.4