Vulnerability RUSTSEC-2026-0536
Summary
Unbounded memory growth from GRAFT messages for unsubscribed topics
Details
When a GRAFT control message arrived, every topic it named was added to that peer's set of topics, on the assumption that a peer grafting us must be subscribed. Nothing checked that the peer had subscribed, and subscription filters only apply to SUBSCRIBE messages. A peer can keep sending GRAFTs with new short topic IDs over one connection, and the set grows until the peer unsubscribes or disconnects. Memory grows without bound and the node can be killed for running out of memory.
The fix no longer records topics from GRAFT messages and drops a GRAFT for a topic the peer has not subscribed to. It also makes MaxCountSubscriptionFilter the default subscription filter. It is in 0.49.5, and was backported to the 0.50 line before 0.50.0.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
