1 line
1.7 KiB
JSON
1 line
1.7 KiB
JSON
{"schema_version":"1.9.2","id":"RUSTSEC-2026-0537","published":"2026-03-27T12:00:00Z","modified":"2026-11-13T12:45:07.345999345Z","aliases":["CVE-2026-34219","GHSA-xqmp-fxgv-xvq5"],"summary":"Remote panic in the heartbeat from a large PRUNE backoff","details":"The 0.49.3 fix stopped an overflow when a PRUNE backoff is first stored, but a backoff just small enough to be stored could still overflow later. On each heartbeat, expired backoffs were found with `backoff_time + slack > now`, which panics when the stored time is close to the largest `Instant`. A peer that sends one PRUNE with such a backoff crashes the node a heartbeat or so later, and can repeat it after every restart.\n\nThe fix caps a remote PRUNE backoff at one hour, uses `checked_add` for the heartbeat comparison, and replaces other unchecked time arithmetic in the behaviour, peer scoring and time cache with checked or saturating operations. It is in 0.49.4.","affected":[{"package":{"name":"libp2p-gossipsub","ecosystem":"crates.io","purl":"pkg:cargo/libp2p-gossipsub"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.49.4"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["denial-of-service"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0537.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/libp2p-gossipsub"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0537.html"},{"type":"WEB","url":"https://github.com/libp2p/rust-libp2p/commit/55e4a64630f66d55fec5955c8f9905413c5d0859"}],"database_specific":{"license":"CC0-1.0"}} |