Loading story…
Two high-severity flaws in the Rust implementation of libp2p allow remote peers to crash applications using the Gossipsub protocol by sending crafted PRUNE control messages with extremely large backoff values. CVE-2026-33040 affects versions prior to 0.49.3, where unchecked time arithmetic in the networking state machine can panic and cause a denial of service, while CVE-2026-34219 affects versions prior to 0.49.4 through improper backoff expiry handling that triggers an Instant + Duration integer overflow during heartbeat processing.
The bugs are reachable over normal Gossipsub peer connectivity, including TCP sessions using Noise with mplex or yamux, and do not require traditional authentication beyond establishing a protocol peer relationship. Both issues are classified under CWE-190 for integer overflow, with the newer advisory also citing CWE-617, and both primarily impact availability by enabling unauthenticated or minimally authenticated remote attackers to force panics in exposed services. Maintainers patched the issues in libp2p-rust versions 0.49.3 and 0.49.4, respectively.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A second Gossipsub denial-of-service flaw involving improper backoff expiry handling and unchecked Instant-plus-Duration arithmetic was patched in libp2p-rust version 0.49.4. The issue affected versions prior to 0.49.4 and could be triggered by a crafted PRUNE control message from a reachable peer.
A denial-of-service vulnerability in the Rust libp2p Gossipsub implementation, caused by unchecked time arithmetic on a crafted PRUNE backoff value, was fixed in libp2p-rust version 0.49.3. The flaw affected versions prior to 0.49.3 and allowed a remote unauthenticated attacker to trigger a panic.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities were disclosed in **rust-openssl**, the Rust bindings for OpenSSL, affecting multiple `0.9.x` and `0.10.x` releases prior to **`0.10.78`**. **`CVE-2026-41898`** affects versions from `0.9.24` up to, but not including, `0.10.78`, where several FFI trampoline callback paths passed a closure-returned `usize` to OpenSSL without validating it against the output buffer size. The flaw can trigger buffer overflows and leak adjacent memory to a network peer, and it is mapped to **`CWE-126`** and **`CWE-130`**. A second issue, **`CVE-2026-41681`**, affects versions from `0.10.39` up to, but not including, `0.10.78`, in `MdCtxRef::digest_final()`, which writes `EVP_MD_CTX_size(ctx)` bytes to the caller buffer without checking whether the buffer is large enough. The resulting out-of-bounds write can cause stack corruption and is reachable from safe Rust, with the weakness classified as **`CWE-121`**. Both vulnerabilities were addressed in **`rust-openssl 0.10.78`**, with public advisories, code references, and fix details released alongside the CVE records.
Jun 29, 2026
Red Hat disclosed **CVE-2026-10649**, an Important-severity flaw in Pacemaker that can let an unauthenticated remote attacker crash the service by sending a crafted compressed message to the CIB remote listener. The bug is an integer overflow in remote message decompression in `lib/common/remote.c`, specifically `pcmk__remote_message_xml()`, where attacker-controlled header fields are used in size calculations before allocation, creating a pre-authentication path to memory corruption and denial of service. The issue is reachable over the network when `remote-port` or `remote-tls-port` is enabled; in TLS deployments, an attacker must first complete the GnuTLS handshake. ClusterLabs published upstream fixes in pull request **#4128**, adding stricter header validation, overflow-safe arithmetic, corrected size checks, clearer error handling, and a **20 MB** cap on remote message size to prevent crashes, memory corruption, and unbounded memory allocation that could also contribute to node fencing. Maintainers noted Pacemaker has not used its remote message compression code since it was introduced in 2013, which may explain why the defect went unnoticed. Until patched builds are deployed, defenders are advised to disable the CIB remote listener if it is not needed or restrict access to trusted peers only.
Jul 12, 2026
A remotely triggerable heap buffer overflow in **Knot Resolver 6.3.0** allows unauthenticated remote code execution through the `kresd` DNS-over-QUIC listener. The flaw stems from incorrect size tracking during inbound QUIC `STREAM` frame reassembly, causing a later `memcpy()` to write past an allocated heap buffer. Public reporting said a single QUIC connection carrying six crafted `STREAM` frames can produce a controlled out-of-bounds write and, with heap grooming, overwrite a `libgnutls` cleanup handler to seize control of a function pointer and argument. Researchers classified the issue as **`CWE-787`** and demonstrated end-to-end RCE in a Debian 12 lab environment with ASLR disabled; failed attempts can also crash worker processes and cause denial of service. CZ.NIC fixed the vulnerability in **Knot Resolver 6.4.1**, and full technical details plus working proof-of-concept exploit code were disclosed publicly shortly after the patch release. No in-the-wild exploitation has been confirmed, but the exposure is significant because Knot Resolver is deployed by major ISPs and handles untrusted network traffic, raising the risk of resolver compromise and forged DNS responses for downstream users. Organizations are being urged to upgrade to **6.4.1** immediately; if patching cannot be completed at once, defenders should disable DNS-over-QUIC, restrict access to the DoQ service, and monitor for repeated `kresd` worker crashes that could indicate exploitation attempts.
Jul 26, 2026