{"action":"Upgrade libp2p-gossipsub to 0.49.4 or later.","affected":[{"fixed":"0.49.4","introduced":"0"}],"component":"libp2p-gossipsub","cve_ids":["CVE-2026-34219"],"ecosystem":"crates.io","epss":0.00583,"exploited":false,"fixed_versions":["0.49.4"],"ghsa_id":"GHSA-xqmp-fxgv-xvq5","id":"tcs_01M5KF4W4JR7FP34NYQVW4XPEA","modified_at":"2026-04-06T23:34:56.143916Z","published_at":"2026-03-30T13:04:03Z","references":["https://osv.dev/vulnerability/GHSA-xqmp-fxgv-xvq5","https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-xqmp-fxgv-xvq5","https://nvd.nist.gov/vuln/detail/CVE-2026-34219","https://github.com/advisories/GHSA-gc42-3jg7-rxr2","https://github.com/libp2p/rust-libp2p"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-xqmp-fxgv-xvq5","url":"https://osv.dev/vulnerability/GHSA-xqmp-fxgv-xvq5"}],"summary":"libp2p-gossipsub: Remote crash via unchecked Instant overflow in heartbeat backoff expiry handling"}