High
libp2p-rust: Gossipsub GRAFT topics unbounded growth
Type: advisorySources: OSV
libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.49.5, Gossipsub GRAFT control-message handling unconditionally adds attacker-supplied topic hashes to connected_peer.topics without confirming that the peer previously subscribed to those topics. A remote unauthenticated peer that can reach a Gossipsub listener can repeatedly send novel GRAFT topics, causing cumulative per-peer memory growth that is not bounded by subscription filters, peer scoring, or per-message size limits. This can exhaust process memory and cause a denial of service. This issue is fixed in version 0.49.5.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-95859
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 7 Nov 2026, 03:11 UTC · Revision 1
Source evidence
libp2p-rust: Gossipsub GRAFT topics unbounded growth
core-osv · Original sourcePublished 16 Oct 2026, 15:19 UTC
libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.49.5, Gossipsub GRAFT control-message handling unconditionally adds attacker-supplied topic hashes to connected_peer.topics without confirming that the peer previously subscribed to those topics. A remote unauthenticated peer that can reach a Gossipsub listener can repeatedly send novel GRAFT topics, causing cumulative per-peer memory growth that is not bounded by subscription filters, peer scoring, or per-message size limits. This can exhaust process memory and cause a denial of service. This issue is fixed in version 0.49.5.
osv:CVE-2026-95859
Complete source record
{
"id": "88bd0714fdbf62e8cbc22b4486f3c0b094949e74a7daad318c8624e1ecc94633",
"url": "https://osv.dev/vulnerability/CVE-2026-95859",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "libp2p-rust: Gossipsub GRAFT topics unbounded growth",
"summary": "libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.49.5, Gossipsub GRAFT control-message handling unconditionally adds attacker-supplied topic hashes to connected_peer.topics without confirming that the peer previously subscribed to those topics. A remote unauthenticated peer that can reach a Gossipsub listener can repeatedly send novel GRAFT topics, causing cumulative per-peer memory growth that is not bounded by subscription filters, peer scoring, or per-message size limits. This can exhaust process memory and cause a denial of service. This issue is fixed in version 0.49.5.",
"evidence": "osv:CVE-2026-95859",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-95859",
"aliases": [
"CVE-2026-95859",
"GHSA-g3g5-x568-qvqx"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/libp2p/rust-libp2p",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "51ed5f00e1b0620ded3444ecadf18477052148ea"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"fixed": "51ed5f00e1b0620ded3444ecadf18477052148ea"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"libp2p-websocket-v0.45.1",
"libp2p-webrtc-v0.9.0-alpha.1",
"libp2p-tls-v0.6.2",
"libp2p-swarm-v0.47.0",
"libp2p-swarm-test-v0.6.0",
"libp2p-relay-v0.20.0",
"libp2p-quic-v0.13.1",
"libp2p-quic-v0.13.0",
"libp2p-mdns-v0.48.0",
"libp2p-identify-v0.47.0",
"libp2p-gossipsub-v0.49.0",
"libp2p-upnp-v0.5.0",
"libp2p-stream-v0.4.0-alpha",
"libp2p-request-response-v0.29.0",
"libp2p-rendezvous-v0.17.0",
"libp2p-relay-v0.21.0",
"libp2p-ping-v0.47.0",
"libp2p-metrics-v0.17.0",
"libp2p-memory-connection-limits-v0.5.0",
"libp2p-kad-v0.48.0",
"libp2p-floodsub-v0.47.0",
"libp2p-dcutr-v0.14.0",
"libp2p-connection-limits-v0.6.0",
"libp2p-autonat-v0.15.0",
"libp2p-allow-block-list-v0.6.0",
"libp2p-gossipsub-v0.49.2",
"libp2p-gossipsub-v0.49.1",
"v0.56.0",
"libp2p-v0.56.0",
"libp2p-server-v0.12.7",
"libp2p-webtransport-websys-v0.5.1",
"libp2p-uds-v0.43.0",
"libp2p-tcp-v0.44.0",
"libp2p-swarm-derive-v0.35.1",
"libp2p-noise-v0.46.1",
"libp2p-mplex-v0.43.1",
"libp2p-dns-v0.44.0",
"libp2p-core-v0.43.1",
"libp2p-identity-v0.2.12",
"libp2p-identity-v0.2.11",
"libp2p-identity-v0.11.0",
"v0.55.0",
"libp2p-yamux-v0.47.0",
"libp2p-webtransport-websys-0.5.0",
"libp2p-websocket-websys-v0.5.0",
"libp2p-websocket-v0.45.0",
"libp2p-webrtc-v0.9.0-alpha",
"libp2p-webrtc-utils-v0.4.0",
"libp2p-v0.55.0",
"libp2p-upnp-v0.4.0",
"libp2p-uds-v0.42.0",
"libp2p-tls-v0.6.0",
"libp2p-tcp-v0.43.0",
"libp2p-swarm-test-v0.5.0",
"libp2p-stream-v0.3.0-alpha",
"libp2p-stream-0.3.0-alpha",
"libp2p-server-v0.12.6",
"libp2p-request-response-v0.28.0",
"libp2p-rendezvous-v0.16.0",
"libp2p-relay-v0.19.0",
"libp2p-quic-v0.12.0",
"libp2p-plaintext-v0.46.0",
"libp2p-ping-v0.46.0",
"libp2p-noise-v0.46.0",
"libp2p-mplex-v0.43.0",
"libp2p-metrics-v0.16.0",
"libp2p-memory-connection-limits-v0.4.0",
"libp2p-mdns-v0.47.0",
"libp2p-kad-v0.47.0",
"libp2p-kad-v0.46.0",
"libp2p-identity-v0.2.10",
"libp2p-identify-v0.46.0",
"libp2p-gossipsub-v0.48.0",
"libp2p-floodsub-v0.46.0",
"libp2p-dns-v0.43.0",
"libp2p-dcutr-v0.13.0",
"libp2p-connection-limits-v0.5.0",
"libp2p-autonat-v0.14.0",
"libp2p-allow-block-list-v0.5.0",
"libp2p-tcp-v0.42.1",
"libp2p-swarm-v0.46.0",
"libp2p-noise-v0.45.1",
"libp2p-dns-v0.42.1",
"libp2p-core-v0.43.0",
"v0.54.1",
"llibp2p-swarm-derive-v0.35.0",
"libp2p-swarm-derive-v0.35.0",
"libp2p-webrtc-utils-v0.3.0",
"libp2p-v0.54.0",
"libp2p-webrtc-v0.7.1-alpha",
"libp2p-upnp-v0.2.1",
"libp2p-stream-v0.1.0-alpha",
"libp2p-yamux-v0.45.1",
"libp2p-websocket-websys-v0.3.1",
"libp2p-webrtc-websys-v0.3.0-alpha",
"libp2p-v0.53.2",
"libp2p-swarm-v0.44.1",
"libp2p-swarm-derive-v0.34.1",
"libp2p-server-v0.12.5",
"libp2p-request-response-v0.26.1",
"libp2p-quic-v0.10.2",
"libp2p-kad-v0.45.3",
"libp2p-identify-v0.44.1",
"libp2p-gossipsub-v0.46.1",
"libp2p-connection-limits-v0.3.1",
"quick-protobuf-codec-v0.3.1",
"libp2p-webrtc-utils-v0.2.0",
"libp2p-core-v0.41.2",
"libp2p-webrtc-v0.7.0-alpha",
"libp2p-mdns-v0.45.1",
"quick-protobuf-codec-v0.3.0",
"libp2p-relay-v0.17.1",
"futures-bounded-v0.2.3",
"futures-bounded-v0.2.2",
"libp2p-identity-v0.2.8",
"libp2p-dns-v0.41.1",
"libp2p-v0.53.1",
"libp2p-server-v0.12.4",
"libp2p-quic-v0.10.1",
"libp2p-metrics-v0.14.1",
"libp2p-kad-v0.45.1",
"libp2p-core-v0.41.1",
"libp2p-yamux-v0.45.0",
"libp2p-webtransport-websys-v0.2.0",
"libp2p-websocket-websys-v0.3.0",
"libp2p-websocket-v0.43.0",
"libp2p-v0.53.0",
"libp2p-upnp-v0.2.0",
"libp2p-uds-v0.40.0",
"libp2p-tls-v0.3.0",
"libp2p-tcp-v0.41.0",
"libp2p-swarm-v0.44.0",
"libp2p-swarm-test-v0.3.0",
"libp2p-swarm-derive-v0.34.0",
"libp2p-request-response-v0.26.0",
"libp2p-rendezvous-v0.14.0",
"libp2p-relay-v0.17.0",
"libp2p-quic-v0.10.0",
"libp2p-pnet-v0.24.0",
"libp2p-plaintext-v0.41.0",
"libp2p-ping-v0.44.0",
"libp2p-perf-v0.3.0",
"libp2p-noise-v0.44.0",
"libp2p-mplex-v0.41.0",
"libp2p-metrics-v0.14.0",
"libp2p-memory-connection-limits-v0.2.0",
"libp2p-mdns-v0.45.0",
"libp2p-kad-v0.45.0",
"libp2p-identify-v0.44.0",
"libp2p-gossipsub-v0.46.0",
"libp2p-floodsub-v0.44.0",
"libp2p-dns-v0.41.0",
"libp2p-dcutr-v0.11.0",
"libp2p-core-v0.41.0",
"libp2p-connection-limits-v0.3.0",
"libp2p-autonat-v0.12.0",
"libp2p-allow-block-list-v0.3.0",
"hole-punching-tests-v0.1.0",
"futures-bounded-v0.2.1",
"libp2p-websocket-websys-v0.2.0",
"libp2p-webrtc-websys-v0.2.0-alpha",
"libp2p-v0.52.4",
"libp2p-upnp-v0.1.1",
"libp2p-tcp-v0.40.1",
"libp2p-swarm-v0.43.6",
"libp2p-request-response-v0.25.2",
"libp2p-rendezvous-v0.13.1",
"libp2p-relay-v0.16.2",
"libp2p-quic-v0.9.3",
"libp2p-pnet-v0.23.1",
"libp2p-plaintext-v0.40.1",
"libp2p-noise-v0.43.2",
"libp2p-kad-v0.44.6",
"libp2p-identity-v0.2.7",
"libp2p-identify-v0.43.1",
"libp2p-gossipsub-v0.45.2",
"libp2p-dns-v0.40.1",
"libp2p-deflate-v0.40.1",
"libp2p-noise-0.43.2",
"libp2p-swarm-v0.43.5",
"upnp-example-v0.1.0",
"libp2p-webrtc-websys-v0.1.0-alpha",
"libp2p-webrtc-v0.6.1-alpha",
"libp2p-webrtc-utils-v0.1.0",
"libp2p-upnp-v0.1.0",
"libp2p-swarm-v0.43.4",
"libp2p-server-v0.12.3",
"libp2p-ping-v0.43.1",
"libp2p-kad-v0.44.5",
"libp2p-core-v0.40.1",
"ipfs-private-example-v0.1.0",
"ipfs-kad-example-v0.1.0",
"identify-example-v0.1.0",
"futures-bounded-v0.1.0",
"file-sharing-example-v0.1.0",
"distributed-key-value-store-example-v0.1.0",
"dcutr-example-v0.1.0",
"browser-webrtc-example-v0.1.0",
"libp2p-server-v0.12.2",
"libp2p-websocket-v0.42.1",
"libp2p-v0.52.3",
"libp2p-tls-v0.2.1",
"libp2p-quic-v0.9.2",
"libp2p-noise-v0.43.1",
"libp2p-identity-v0.2.3",
"libp2p-quic-v0.9.2-alpha",
"libp2p-yamux-v0.44.1",
"libp2p-v0.52.2",
"libp2p-swarm-v0.43.3",
"libp2p-request-response-v0.25.1",
"libp2p-relay-v0.16.1",
"libp2p-quic-v0.9.1-alpha",
"libp2p-metrics-v0.13.1",
"libp2p-memory-connection-limits-v0.1.0",
"libp2p-kad-v0.44.4",
"libp2p-gossipsub-v0.45.1",
"libp2p-swarm-v0.43.2",
"libp2p-identity-v0.2.2",
"libp2p-connection-limits-v0.2.1",
"libp2p-quic-v0.9.0-alpha",
"libp2p-kad-v0.44.3",
"libp2p-swarm-v0.43.1",
"libp2p-kad-v0.44.2",
"libp2p-identity-v0.2.1",
"libp2p-kad-v0.44.1",
"libp2p-webrtc-v0.6.0-alpha",
"webtransport-tests-v0.1.0",
"libp2p-webtransport-websys-v0.1.0",
"libp2p-v0.52.1",
"quick-protobuf-codec-v0.2.0",
"multistream-select-v0.13.0",
"libp2p-yamux-v0.44.0",
"libp2p-websocket-v0.42.0",
"libp2p-webrtc-v0.5.0-alpha",
"libp2p-wasm-ext-v0.40.0",
"libp2p-v0.52.0",
"libp2p-uds-v0.39.0",
"libp2p-tls-v0.2.0",
"libp2p-tcp-v0.40.0",
"libp2p-swarm-v0.43.0",
"libp2p-swarm-test-v0.2.0",
"libp2p-swarm-derive-v0.33.0",
"libp2p-request-response-v0.25.0",
"libp2p-rendezvous-v0.13.0",
"libp2p-relay-v0.16.0",
"libp2p-quic-v0.8.0-alpha",
"libp2p-pnet-v0.23.0",
"libp2p-plaintext-v0.40.0",
"libp2p-ping-v0.43.0",
"libp2p-perf-v0.2.0",
"libp2p-noise-v0.43.0",
"libp2p-mplex-v0.40.0",
"libp2p-metrics-v0.13.0",
"libp2p-mdns-v0.44.0",
"libp2p-kad-v0.44.0",
"libp2p-identify-v0.43.0",
"libp2p-gossipsub-v0.45.0",
"libp2p-floodsub-v0.43.0",
"libp2p-dns-v0.40.0",
"libp2p-deflate-v0.40.0",
"libp2p-dcutr-v0.10.0",
"libp2p-connection-limits-v0.2.0",
"libp2p-autonat-v0.11.0",
"libp2p-allow-block-list-v0.2.0",
"rw-stream-sink-v0.4.0",
"libp2p-core-v0.40.0",
"libp2p-identity-v0.2.0",
"libp2p-yamux-v0.43.1",
"libp2p-swarm-v0.42.2",
"libp2p-request-response-v0.24.1",
"libp2p-noise-v0.42.2",
"libp2p-kad-v0.43.3",
"libp2p-identity-v0.1.2",
"libp2p-identify-v0.42.2",
"libp2p-gossipsub-v0.44.4",
"libp2p-core-v0.39.2",
"libp2p-allow-block-list-v0.1.1",
"metrics-example-v0.1.0",
"libp2p-v0.51.3",
"libp2p-relay-v0.15.2",
"libp2p-kad-v0.43.2",
"libp2p-gossipsub-v0.44.3",
"libp2p-autonat-v0.10.2",
"relay-server-example-v0.1.0",
"libp2p-webrtc-v0.4.0-alpha.4",
"libp2p-v0.51.2",
"libp2p-swarm-v0.42.1",
"libp2p-perf-v0.1.0",
"libp2p-mdns-v0.43.1",
"libp2p-gossipsub-v0.44.2",
"libp2p-connection-limits-v0.1.0",
"libp2p-allow-block-list-v0.1.0",
"autonat-example-v0.1.0",
"libp2p-identity-v0.1.1",
"rendezvous-example-v0.1.0",
"quick-protobuf-codec-v0.1.0",
"ping-example-v0.1.0",
"libp2p-webrtc-v0.4.0-alpha.3",
"libp2p-v0.51.1",
"libp2p-tls-v0.1.0",
"libp2p-swarm-test-v0.1.0",
"libp2p-rendezvous-v0.12.1",
"libp2p-relay-v0.15.1",
"libp2p-quic-v0.7.0-alpha.3",
"libp2p-pnet-v0.22.3",
"libp2p-plaintext-v0.39.1",
"libp2p-noise-v0.42.1",
"libp2p-kad-v0.43.1",
"libp2p-identity-v0.1.0",
"libp2p-identify-v0.42.1",
"libp2p-gossipsub-v0.44.1",
"libp2p-floodsub-v0.42.1",
"libp2p-dcutr-v0.9.1",
"libp2p-core-v0.39.1",
"libp2p-autonat-v0.10.1",
"ipfs-private-v0.1.0",
"ipfs-kad-v0.1.0",
"interop-tests-v0.1.0",
"identify-v0.1.0",
"file-sharing-v0.1.0",
"distributed-key-value-store-v0.1.0",
"dcutr-v0.1.0",
"chat-example-v0.1.0",
"v0.51.0",
"libp2p-yamux-v0.43.0",
"libp2p-websocket-v0.41.0",
"libp2p-webrtc-v0.4.0-alpha.2",
"libp2p-wasm-ext-v0.39.0",
"libp2p-uds-v0.38.0",
"libp2p-tls-v0.1.0-alpha.2",
"libp2p-tcp-v0.39.0",
"libp2p-swarm-v0.42.0",
"libp2p-swarm-derive-v0.32.0",
"libp2p-request-response-v0.24.0",
"libp2p-rendezvous-v0.12.0",
"libp2p-relay-v0.15.0",
"libp2p-quic-v0.7.0-alpha.2",
"libp2p-plaintext-v0.39.0",
"libp2p-ping-v0.42.0",
"libp2p-noise-v0.42.0",
"libp2p-mplex-v0.39.0",
"libp2p-metrics-v0.12.0",
"libp2p-mdns-v0.43.0",
"libp2p-kad-v0.43.0",
"libp2p-identify-v0.42.0",
"libp2p-gossipsub-v0.44.0",
"libp2p-floodsub-v0.42.0",
"libp2p-dns-v0.39.0",
"libp2p-deflate-v0.39.0",
"libp2p-dcutr-v0.9.0",
"libp2p-core-v0.39.0",
"libp2p-autonat-v0.10.0",
"libp2p-swarm-v0.41.1",
"libp2p-swarm-derive-v0.31.0",
"v0.50.0",
"prost-codec-v0.3.0",
"multistream-select-v0.12.1",
"libp2p-yamux-v0.42.0",
"libp2p-websocket-v0.40.0",
"libp2p-webrtc-v0.4.0-alpha",
"libp2p-wasm-ext-v0.38.0",
"libp2p-uds-v0.37.0",
"libp2p-tls-v0.1.0-alpha",
"libp2p-tcp-v0.38.0",
"libp2p-swarm-v0.41.0",
"libp2p-swarm-derive-v0.30.2",
"libp2p-request-response-v0.23.0",
"libp2p-rendezvous-v0.11.0",
"libp2p-relay-v0.14.0",
"libp2p-quic-v0.7.0-alpha",
"libp2p-pnet-v0.22.2",
"libp2p-plaintext-v0.38.0",
"libp2p-ping-v0.41.0",
"libp2p-noise-v0.41.0",
"libp2p-muxer-test-harness-v0.1.0",
"libp2p-mplex-v0.38.0",
"libp2p-metrics-v0.11.0",
"libp2p-mdns-v0.42.0",
"libp2p-kad-v0.42.0",
"libp2p-identify-v0.41.0",
"libp2p-gossipsub-v0.43.0",
"libp2p-floodsub-v0.41.0",
"libp2p-dns-v0.38.0",
"libp2p-deflate-v0.38.0",
"libp2p-dcutr-v0.8.0",
"libp2p-core-v0.38.0",
"libp2p-autonat-v0.9.0",
"v0.49.0",
"rw-stream-sink-v0.3.0",
"quickcheck-ext-v0.1.0",
"prost-codec-v0.2.0",
"multistream-select-v0.12.0",
"libp2p-yamux-v0.41.0",
"libp2p-websocket-v0.39.0",
"libp2p-wasm-ext-v0.37.0",
"libp2p-uds-v0.36.0",
"libp2p-tcp-v0.37.0",
"libp2p-swarm-v0.40.1",
"libp2p-swarm-derive-v0.30.1",
"libp2p-request-response-v0.22.1",
"libp2p-rendezvous-v0.10.0",
"libp2p-relay-v0.13.0",
"libp2p-pnet-v0.22.1",
"libp2p-plaintext-v0.37.0",
"libp2p-ping-v0.40.1",
"libp2p-noise-v0.40.0",
"libp2p-mplex-v0.37.0",
"libp2p-metrics-v0.10.0",
"libp2p-mdns-v0.41.0",
"libp2p-kad-v0.41.0",
"libp2p-identify-v0.40.0",
"libp2p-gossipsub-v0.42.1",
"libp2p-floodsub-v0.40.1",
"libp2p-dns-v0.37.0",
"libp2p-deflate-v0.37.0",
"libp2p-dcutr-v0.7.0",
"libp2p-core-v0.37.0",
"libp2p-autonat-v0.8.0",
"keygen-v0.1.0",
"v0.48.0",
"libp2p-yamux-0.40.0",
"libp2p-websocket-0.38.0",
"libp2p-wasm-ext-0.36.0",
"libp2p-uds-0.35.0",
"libp2p-tcp-0.36.0",
"libp2p-swarm-derive-0.30.0",
"libp2p-swarm-0.39.0",
"libp2p-request-response-0.21.0",
"libp2p-rendezvous-0.9.0",
"libp2p-relay-0.12.0",
"libp2p-plaintext-0.36.0",
"libp2p-ping-0.39.0",
"libp2p-noise-0.39.0",
"libp2p-mplex-0.36.0",
"libp2p-metrics-0.9.0",
"libp2p-mdns-0.40.0",
"libp2p-kad-0.40.0",
"libp2p-identify-0.39.0",
"libp2p-gossipsub-0.41.0",
"libp2p-floodsub-0.39.0",
"libp2p-dns-0.36.0",
"libp2p-deflate-0.36.0",
"libp2p-dcutr-0.6.0",
"libp2p-core-0.36.0",
"libp2p-autonat-0.7.0",
"libp2p-core-0.35.1",
"libp2p-dcutr-0.5.1",
"v0.47.0",
"prost-codec-0.2.0",
"libp2p-yamux-0.39.0",
"libp2p-websocket-0.37.0",
"libp2p-wasm-ext-0.35.0",
"libp2p-uds-0.34.0",
"libp2p-tcp-0.35.0",
"libp2p-swarm-derive-0.29.0",
"libp2p-swarm-0.38.0",
"libp2p-request-response-0.20.0",
"libp2p-rendezvous-0.8.0",
"libp2p-relay-0.11.0",
"libp2p-plaintext-0.35.0",
"libp2p-ping-0.38.0",
"libp2p-noise-0.38.0",
"libp2p-mplex-0.35.0",
"libp2p-metrics-0.8.0",
"libp2p-mdns-0.39.0",
"libp2p-kad-0.39.0",
"libp2p-identify-0.38.0",
"libp2p-gossipsub-0.40.0",
"libp2p-floodsub-0.38.0",
"libp2p-dns-0.35.0",
"libp2p-deflate-0.35.0",
"libp2p-dcutr-0.5.0",
"libp2p-core-0.35.0",
"libp2p-autonat-0.6.0",
"v0.46.1",
"libp2p-swarm-derive-0.28.0",
"v0.46.0",
"libp2p-yamux-0.38.0",
"libp2p-websocket-0.36.0",
"libp2p-wasm-ext-0.34.0",
"libp2p-uds-0.33.0",
"libp2p-tcp-0.34.0",
"libp2p-swarm-0.37.0",
"libp2p-request-response-0.19.0",
"libp2p-rendezvous-0.7.0",
"libp2p-relay-0.10.0",
"libp2p-plaintext-0.34.0",
"libp2p-ping-0.37.0",
"libp2p-noise-0.37.0",
"libp2p-mplex-0.34.0",
"libp2p-metrics-0.7.0",
"libp2p-mdns-0.38.0",
"libp2p-kad-0.38.0",
"libp2p-identify-0.37.0",
"libp2p-gossipsub-0.39.0",
"libp2p-floodsub-0.37.0",
"libp2p-dns-0.34.0",
"libp2p-deflate-0.34.0",
"libp2p-dcutr-0.4.0",
"libp2p-core-0.34.0",
"libp2p-autonat-0.5.0",
"libp2p-autonat-0.4.1",
"libp2p-metrics-0.6.1",
"libp2p-gossipsub-0.38.1",
"v0.45.1",
"libp2p-swarm-0.36.1",
"libp2p-relay-0.9.1",
"libp2p-kad-0.37.1",
"libp2p-identify-0.36.1",
"libp2p-dcutr-0.3.1",
"v0.45.0",
"rw-stream-sink-0.3.0",
"prost-codec-0.1.0",
"libp2p-yamux-0.37.0",
"libp2p-websocket-0.35.0",
"libp2p-wasm-ext-0.33.0",
"libp2p-tcp-0.33.0",
"libp2p-swarm-derive-0.27.2",
"libp2p-swarm-0.36.0",
"libp2p-request-response-0.18.0",
"libp2p-rendezvous-0.6.0",
"libp2p-relay-0.9.0",
"libp2p-plaintext-0.33.0",
"libp2p-ping-0.36.0",
"libp2p-noise-0.36.0",
"libp2p-mplex-0.33.0",
"libp2p-metrics-0.6.0",
"libp2p-mdns-0.37.0",
"libp2p-kad-0.37.0",
"libp2p-identify-0.36.0",
"libp2p-gossipsub-0.38.0",
"libp2p-floodsub-0.36.0",
"libp2p-dns-0.33.0",
"libp2p-deflate-0.33.0",
"libp2p-dcutr-0.3.0",
"libp2p-core-0.33.0",
"libp2p-autonat-0.4.0",
"v0.44.0",
"libp2p-swarm-0.35.0",
"libp2p-request-response-0.17.0",
"libp2p-rendezvous-0.5.0",
"libp2p-relay-0.8.0",
"libp2p-ping-0.35.0",
"libp2p-metrics-0.5.0",
"libp2p-mdns-0.36.0",
"libp2p-kad-0.36.0",
"libp2p-identify-0.35.0",
"libp2p-gossipsub-0.37.0",
"libp2p-floodsub-0.35.0",
"libp2p-dns-0.32.1",
"libp2p-dcutr-0.2.0",
"libp2p-core-0.32.1",
"libp2p-autonat-0.3.0",
"libp2p-swarm-derive-0.27.1",
"v0.43.0",
"libp2p-yamux-0.36.0",
"libp2p-websocket-0.34.0",
"libp2p-wasm-ext-0.32.0",
"libp2p-uds-0.32.0",
"libp2p-tcp-0.32.0",
"libp2p-swarm-derive-0.27.0",
"libp2p-swarm-0.34.0",
"libp2p-request-response-0.16.0",
"libp2p-rendezvous-0.4.0",
"libp2p-relay-0.7.0",
"libp2p-plaintext-0.32.0",
"libp2p-ping-0.34.0",
"libp2p-noise-0.35.0",
"libp2p-mplex-0.32.0",
"libp2p-metrics-0.4.0",
"libp2p-mdns-0.35.0",
"libp2p-kad-0.35.0",
"libp2p-identify-0.34.0",
"libp2p-gossipsub-0.36.0",
"libp2p-floodsub-0.34.0",
"libp2p-dns-0.32.0",
"libp2p-deflate-0.32.0",
"libp2p-dcutr-0.1.0",
"libp2p-core-0.32.0",
"libp2p-autonat-0.2.0",
"v0.42.1",
"libp2p-tcp-0.31.1",
"libp2p-relay-0.6.1",
"v0.42.0",
"libp2p-swarm-derive-0.26.1",
"libp2p-autonat-0.1.0",
"multistream-select-0.11.0",
"libp2p-yamux-0.35.0",
"libp2p-websocket-0.33.0",
"libp2p-wasm-ext-0.31.0",
"libp2p-uds-0.31.0",
"libp2p-tcp-0.31.0",
"libp2p-swarm-0.33.0",
"libp2p-request-response-0.15.0",
"libp2p-rendezvous-0.3.0",
"libp2p-relay-0.6.0",
"libp2p-plaintext-0.31.0",
"libp2p-ping-0.33.0",
"libp2p-noise-0.34.0",
"libp2p-mplex-0.31.0",
"libp2p-metrics-0.3.0",
"libp2p-mdns-0.34.0",
"libp2p-kad-0.34.0",
"libp2p-identify-0.33.0",
"libp2p-gossipsub-0.35.0",
"libp2p-floodsub-0.33.0",
"libp2p-dns-0.31.0",
"libp2p-deflate-0.31.0",
"libp2p-core-0.31.0",
"v0.41.0",
"libp2p-websocket-0.32.0",
"libp2p-swarm-derive-0.26.0",
"libp2p-swarm-0.32.0",
"libp2p-request-response-0.14.0",
"libp2p-rendezvous-0.2.0",
"libp2p-relay-0.5.0",
"libp2p-ping-0.32.0",
"libp2p-metrics-0.2.0",
"libp2p-mdns-0.33.0",
"libp2p-kad-0.33.0",
"libp2p-identify-0.32.0",
"libp2p-gossipsub-0.34.0",
"libp2p-floodsub-0.32.0",
"v0.40.0-rc.3",
"libp2p-swarm-0.31.0-rc.2",
"libp2p-identify-0.31.0-rc.2",
"libp2p-core-0.30.0-rc.2",
"v0.40.0-rc.2",
"libp2p-kad-0.32.0-rc.2",
"v0.40.0-rc.1",
"multistream-select-0.10.4",
"libp2p-yamux-0.34.0-rc.1",
"libp2p-websocket-0.31.0-rc.1",
"libp2p-wasm-ext-0.30.0-rc.1",
"libp2p-uds-0.30.0-rc.1",
"libp2p-tcp-0.30.0-rc.1",
"libp2p-swarm-derive-0.25.0-rc.1",
"libp2p-swarm-0.31.0-rc.1",
"libp2p-request-response-0.13.0-rc.1",
"libp2p-rendezvous-0.1.0-rc.1",
"libp2p-relay-0.4.0-rc.1",
"libp2p-pnet-0.22.0-rc.1",
"libp2p-plaintext-0.30.0-rc.1",
"libp2p-ping-0.31.0-rc.1",
"libp2p-noise-0.33.0-rc.1",
"libp2p-mplex-0.30.0-rc.1",
"libp2p-metrics-0.1.0-rc.1",
"libp2p-mdns-0.32.0-rc.1",
"libp2p-kad-0.32.0-rc.1",
"libp2p-identify-0.31.0-rc.1",
"libp2p-gossipsub-0.33.0-rc.1",
"libp2p-floodsub-0.31.0-rc.1",
"libp2p-dns-0.30.0-rc.1",
"libp2p-deflate-0.30.0-rc.1",
"libp2p-core-0.30.0-rc.1",
"parity-multiaddr-0.11.2",
"libp2p-yamux-0.31.0",
"libp2p-websocket-0.29.0",
"libp2p-wasm-ext-0.28.0",
"libp2p-uds-0.28.0",
"libp2p-tcp-0.28.0",
"libp2p-swarm-0.28.0",
"libp2p-request-response-0.10.0",
"libp2p-relay-0.1.0",
"libp2p-plaintext-0.28.0",
"libp2p-ping-0.28.0",
"libp2p-noise-0.30.0",
"libp2p-mplex-0.28.0",
"libp2p-mdns-0.29.0",
"libp2p-kad-0.29.0",
"libp2p-identify-0.28.0",
"libp2p-gossipsub-0.29.0",
"libp2p-floodsub-0.28.0",
"libp2p-deflate-0.28.0",
"libp2p-core-0.28.0",
"v0.39.1",
"libp2p-swarm-derive-0.24.0",
"v0.39.0",
"libp2p-yamux-0.33.0",
"libp2p-websocket-0.30.0",
"libp2p-wasm-ext-0.29.0",
"libp2p-uds-0.29.0",
"libp2p-tcp-0.29.0",
"libp2p-swarm-0.30.0",
"libp2p-request-response-0.12.0",
"libp2p-relay-0.3.0",
"libp2p-plaintext-0.29.0",
"libp2p-ping-0.30.0",
"libp2p-noise-0.32.0",
"libp2p-mplex-0.29.0",
"libp2p-mdns-0.31.0",
"libp2p-kad-0.31.0",
"libp2p-identify-0.30.0",
"libp2p-gossipsub-0.32.0",
"libp2p-floodsub-0.30.0",
"libp2p-dns-0.29.0",
"libp2p-deflate-0.29.0",
"libp2p-core-0.29.0",
"v0.38.0",
"libp2p-pnet-0.21.0",
"libp2p-noise-0.31.0",
"libp2p-gossipsub-0.31.0",
"libp2p-mdns-0.30.2",
"libp2p-wasm-ext-0.28.2",
"libp2p-gossipsub-0.30.1",
"libp2p-core-0.28.3",
"libp2p-mdns-0.30.1",
"v0.37.1",
"libp2p-swarm-derive-0.23.0",
"v0.37.0",
"libp2p-yamux-0.32.0",
"libp2p-swarm-0.29.0",
"libp2p-request-response-0.11.0",
"libp2p-relay-0.2.0",
"libp2p-ping-0.29.0",
"libp2p-mdns-0.30.0",
"libp2p-kad-0.30.0",
"libp2p-identify-0.29.0",
"libp2p-gossipsub-0.30.0",
"libp2p-floodsub-0.29.0",
"libp2p-core-0.28.2",
"libp2p-dns-0.28.1",
"libp2p-wasm-ext-0.28.1",
"v0.36.0",
"libp2p-dns-0.28.0",
"libp2p-core-0.28.1",
"multistream-select-0.10.2",
"v0.35.1",
"libp2p-yamux-0.30.1",
"v0.35",
"parity-multiaddr-0.11.1",
"multistream-select-0.10.1",
"libp2p-tcp-0.27.1",
"libp2p-swarm-derive-0.22.0",
"libp2p-request-response-0.9.1",
"libp2p-plaintext-0.27.1",
"libp2p-mplex-0.27.1",
"libp2p-mdns-0.28.1",
"libp2p-kad-0.28.1",
"libp2p-gossipsub-0.28.0",
"libp2p-core-0.27.1",
"libp2p-swarm-0.27.2",
"libp2p-deflate-0.27.1",
"libp2p-swarm-0.27.1",
"parity-multiaddr-0.9.6",
"v0.34.0",
"libp2p-gossipsub-0.27.0",
"parity-multiaddr-0.11.0",
"multistream-select-0.10.0",
"libp2p-yamux-0.30.0",
"libp2p-websocket-0.28.0",
"libp2p-wasm-ext-0.27.0",
"libp2p-uds-0.27.0",
"libp2p-tcp-0.27.0",
"libp2p-swarm-0.27.0",
"libp2p-request-response-0.9.0",
"libp2p-plaintext-0.27.0",
"libp2p-ping-0.27.0",
"libp2p-noise-0.29.0",
"libp2p-mplex-0.27.0",
"libp2p-mdns-0.28.0",
"libp2p-kad-0.28.0",
"libp2p-identify-0.27.0",
"libp2p-floodsub-0.27.0",
"libp2p-dns-0.27.0",
"libp2p-deflate-0.27.0",
"libp2p-core-0.27.0",
"libp2p-kad-v0.27.1",
"v0.33.0",
"libp2p-yamux-0.29.0",
"libp2p-websocket-0.27.0",
"libp2p-wasm-ext-0.26.0",
"libp2p-uds-0.26.0",
"libp2p-tcp-0.26.0",
"libp2p-swarm-0.26.0",
"libp2p-secio-0.26.0",
"libp2p-request-response-0.8.0",
"libp2p-pnet-0.20.0",
"libp2p-plaintext-0.26.0",
"libp2p-ping-0.26.0",
"libp2p-noise-0.28.0",
"libp2p-mplex-0.26.0",
"libp2p-mdns-0.27.0",
"libp2p-kad-0.27.0",
"libp2p-identify-0.26.0",
"libp2p-gossipsub-0.26.0",
"libp2p-floodsub-0.26.0",
"libp2p-dns-0.26.0",
"libp2p-deflate-0.26.0",
"libp2p-core-0.26.0",
"v0.32.2",
"libp2p-websocket-0.26.3",
"v0.32.1",
"libp2p-websocket-0.26.2",
"v0.32.0",
"libp2p-request-response-0.7.0",
"libp2p-mdns-0.26.0",
"libp2p-websocket-0.26.1",
"v0.31.2",
"multistream-select-0.9.1",
"libp2p-core-0.25.2",
"libp2p-swarm-0.25.1",
"v0.31.1",
"libp2p-tcp-0.25.1",
"v0.31.0",
"parity-multiaddr-0.10.0",
"libp2p-core-0.25.1",
"multistream-select-0.9.0",
"libp2p-yamux-0.28.0",
"libp2p-websocket-0.26.0",
"libp2p-wasm-ext-0.25.0",
"libp2p-uds-0.25.0",
"libp2p-tcp-0.25.0",
"libp2p-swarm-0.25.0",
"libp2p-secio-0.25.0",
"libp2p-request-response-0.6.0",
"libp2p-plaintext-0.25.0",
"libp2p-ping-0.25.0",
"libp2p-noise-0.27.0",
"libp2p-mplex-0.25.0",
"libp2p-mdns-0.25.0",
"libp2p-kad-0.26.0",
"libp2p-identify-0.25.0",
"libp2p-gossipsub-0.25.0",
"libp2p-floodsub-0.25.0",
"libp2p-dns-0.25.0",
"libp2p-deflate-0.25.0",
"libp2p-core-derive-0.21.0",
"libp2p-core-0.25.0",
"parity-multiaddr-0.9.5",
"v0.30.1",
"libp2p-secio-0.24.0",
"libp2p-plaintext-0.24.1",
"v0.30.0",
"parity-multiaddr-0.9.4",
"libp2p-yamux-0.27.0",
"libp2p-websocket-0.25.0",
"libp2p-wasm-ext-0.24.0",
"libp2p-uds-0.24.0",
"libp2p-tcp-0.24.0",
"libp2p-swarm-0.24.0",
"libp2p-request-response-0.5.0",
"libp2p-plaintext-0.24.0",
"libp2p-ping-0.24.0",
"libp2p-noise-0.26.0",
"libp2p-mplex-0.24.0",
"libp2p-mdns-0.24.0",
"libp2p-kad-0.25.0",
"libp2p-identify-0.24.0",
"libp2p-gossipsub-0.24.0",
"libp2p-floodsub-0.24.0",
"libp2p-dns-0.24.0",
"libp2p-deflate-0.24.0",
"libp2p-core-0.24.0",
"multistream-select-0.8.5",
"libp2p-mplex-0.23.1",
"v0.29.1",
"libp2p-core-0.23.1",
"multistream-select-0.8.4",
"v0.29.0",
"parity-multiaddr-0.9.3",
"multistream-select-0.8.3",
"libp2p-yamux-0.26.0",
"libp2p-websocket-0.24.0",
"libp2p-wasm-ext-0.23.0",
"libp2p-uds-0.23.0",
"libp2p-tcp-0.23.0",
"libp2p-swarm-0.23.0",
"libp2p-secio-0.23.0",
"libp2p-request-response-0.4.0",
"libp2p-pnet-0.29.2",
"libp2p-plaintext-0.23.0",
"libp2p-ping-0.23.0",
"libp2p-noise-0.25.0",
"libp2p-mplex-0.23.0",
"libp2p-mdns-0.23.0",
"libp2p-kad-0.24.0",
"libp2p-identify-0.23.0",
"libp2p-gossipsub-0.23.0",
"libp2p-floodsub-0.23.0",
"libp2p-dns-0.23.0",
"libp2p-deflate-0.23.0",
"libp2p-core-0.23.0",
"v0.28.1",
"libp2p-core-0.22.1",
"v0.28.0",
"libp2p-yamux-0.25.0",
"v0.27.0",
"libp2p-yamux-0.24.0",
"v0.26.0",
"libp2p-yamux-0.23.0",
"v0.25.0",
"libp2p-yamux-0.22.0",
"libp2p-websocket-0.23.0",
"libp2p-wasm-ext-0.22.0",
"libp2p-uds-0.22.0",
"libp2p-tcp-0.22.0",
"libp2p-swarm-0.22.0",
"libp2p-secio-0.22.0",
"libp2p-request-response-0.3.0",
"libp2p-plaintext-0.22.0",
"libp2p-ping-0.22.0",
"libp2p-noise-0.24.0",
"libp2p-mplex-0.22.0",
"libp2p-mdns-0.22.0",
"libp2p-kad-0.23.0",
"libp2p-identify-0.22.0",
"libp2p-gossipsub-0.22.0",
"libp2p-floodsub-0.22.0",
"libp2p-dns-0.22.0",
"libp2p-deflate-0.22.0",
"libp2p-core-0.22.0",
"parity-multiaddr-0.9.2",
"libp2p-kad-0.22.1",
"v0.24.0",
"libp2p-yamux-0.21.0",
"libp2p-websocket-0.22.0",
"libp2p-wasm-ext-0.21.0",
"libp2p-uds-0.21.0",
"libp2p-tcp-0.21.0",
"libp2p-swarm-0.21.0",
"libp2p-secio-0.21.0",
"libp2p-request-response-0.2.0",
"libp2p-plaintext-0.21.0",
"libp2p-ping-0.21.0",
"libp2p-noise-0.23.0",
"libp2p-mplex-0.21.0",
"libp2p-mdns-0.21.0",
"libp2p-kad-0.22.0",
"libp2p-identify-0.21.0",
"libp2p-gossipsub-0.21.0",
"libp2p-floodsub-0.21.0",
"libp2p-dns-0.21.0",
"libp2p-deflate-0.21.0",
"libp2p-core-0.21.0",
"v0.23.0",
"libp2p-noise-0.22.0",
"libp2p-core-derive-0.20.2",
"v0.22.0",
"libp2p-noise-0.21.0",
"libp2p-core-0.20.1",
"libp2p-request-response-0.1.1",
"libp2p-websocket-0.21.1",
"libp2p-swarm-0.20.1",
"libp2p-core-derive-0.20.1",
"libp2p-wasm-ext-0.20.1",
"v0.21.1",
"libp2p-websocket-0.21.0",
"v0.21.0",
"libp2p-yamux-0.20.0",
"libp2p-websocket-0.20.1",
"libp2p-wasm-ext-0.20.0",
"libp2p-uds-0.20.0",
"libp2p-tcp-0.20.0",
"libp2p-swarm-0.20.0",
"libp2p-secio-0.20.0",
"libp2p-plaintext-0.20.0",
"libp2p-ping-0.20.0",
"libp2p-noise-0.20.0",
"libp2p-mplex-0.20.0",
"libp2p-mdns-0.20.0",
"libp2p-kad-0.21.0",
"libp2p-identify-0.20.0",
"libp2p-gossipsub-0.20.0",
"libp2p-floodsub-0.20.0",
"libp2p-dns-0.20.0",
"libp2p-deflate-0.20.0",
"libp2p-core-derive-0.20.0",
"libp2p-core-0.20.0",
"v0.20.1",
"libp2p-kad-0.20.1",
"libp2p-gossipsub-0.19.3",
"v0.20.0",
"parity-multiaddr-0.9.1",
"multistream-select-0.8.2",
"libp2p-yamux-0.19.1",
"libp2p-websocket-0.20.0",
"libp2p-uds-0.19.2",
"libp2p-tcp-0.19.2",
"libp2p-swarm-0.19.1",
"libp2p-secio-0.19.2",
"libp2p-pnet-0.19.1",
"libp2p-plaintext-0.19.1",
"libp2p-ping-0.19.3",
"libp2p-noise-0.19.1",
"libp2p-mplex-0.19.2",
"libp2p-mdns-0.19.2",
"libp2p-kad-0.20.0",
"libp2p-identify-0.19.2",
"libp2p-gossipsub-0.19.2",
"libp2p-floodsub-0.19.1",
"libp2p-deflate-0.19.2",
"libp2p-core-0.19.2",
"libp2p-ping-v0.19.2",
"v0.19.1",
"v0.19.0",
"v0.18.1",
"v0.18.0",
"v0.17.0",
"v0.16.2",
"v0.16.1",
"v0.16.0",
"v0.15.0",
"v0.14.0-alpha.1",
"v0.13.2",
"0.13.2",
"v0.13.1",
"v0.13.0",
"v0.12.0",
"v0.11.0",
"v0.10.0",
"v0.9.1",
"v0.9.0",
"v0.7.0",
"v0.8.0",
"v0.6.0",
"v0.5.0",
"v0.4.2",
"v0.4.0",
"v0.3.1",
"v0.3.0",
"v0.2.2",
"v0.2.1",
"v0.2.0",
"v0.1.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-95859.json"
}
}
],
"modified": "2026-10-28T02:30:49.238245477Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/95xxx/CVE-2026-95859.json",
"https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-g3g5-x568-qvqx",
"https://nvd.nist.gov/vuln/detail/CVE-2026-95859",
"https://github.com/libp2p/rust-libp2p/commit/51ed5f00e1b0620ded3444ecadf18477052148ea",
"https://github.com/libp2p/rust-libp2p/pull/6608"
],
"provider_metadata": {
"cwe_ids": [
"CWE-770"
],
"cna_assigner": "GitHub_M",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"fixed": "0.49.5"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
}
]
},
{
"extracted_events": [
{
"range": [
{
"fixed": "0.49.5"
},
{
"fixed": "0.49.5"
}
],
"source": "DESCRIPTION"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/95xxx/CVE-2026-95859.json"
}
},
"related_cves": [
{
"value": "CVE-2026-95859",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 517649,
"published_at": "2026-10-16T15:19:04.504+00:00"
}