CVE-2026-95859
Description
A flaw was found in libp2p-gossipsub. This issue allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending crafted GRAFT control messages with arbitrary topic identifiers. Because the service unconditionally records these topics without validating prior subscriptions, it triggers unbounded memory consumption, exhausting system memory and causing the application to crash.
Statement
This vulnerability is rated Important by Red Hat because an unauthenticated remote attacker can trigger unbounded memory allocation over the network without requiring privileges or user interaction, leading to a complete denial of service. The libp2p-gossipsub library is not distributed or utilized by default within Red Hat Enterprise Linux. Consequently, standard Red Hat environments are not affected unless custom or third-party Rust software implementing the Gossipsub protocol is deployed.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
