1 line
1.8 KiB
JSON
1 line
1.8 KiB
JSON
{"schema_version":"1.9.2","id":"RUSTSEC-2026-0536","published":"2026-09-05T12:00:00Z","modified":"2026-11-13T12:45:02.747808849Z","aliases":["CVE-2026-95859","GHSA-g3g5-x568-qvqx"],"summary":"Unbounded memory growth from GRAFT messages for unsubscribed topics","details":"When a GRAFT control message arrived, every topic it named was added to that peer's set of topics, on the assumption that a peer grafting us must be subscribed. Nothing checked that the peer had subscribed, and subscription filters only apply to SUBSCRIBE messages. A peer can keep sending GRAFTs with new short topic IDs over one connection, and the set grows until the peer unsubscribes or disconnects. Memory grows without bound and the node can be killed for running out of memory.\n\nThe fix no longer records topics from GRAFT messages and drops a GRAFT for a topic the peer has not subscribed to. It also makes `MaxCountSubscriptionFilter` the default subscription filter. It is in 0.49.5, and was backported to the 0.50 line before 0.50.0.","affected":[{"package":{"name":"libp2p-gossipsub","ecosystem":"crates.io","purl":"pkg:cargo/libp2p-gossipsub"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.49.5"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["denial-of-service"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0536.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/libp2p-gossipsub"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0536.html"},{"type":"WEB","url":"https://github.com/libp2p/rust-libp2p/commit/51ed5f00e1b0620ded3444ecadf18477052148ea"},{"type":"WEB","url":"https://github.com/libp2p/rust-libp2p/pull/6608"}],"database_specific":{"license":"CC0-1.0"}} |