NRDAX-T0188 - Oversized Control-Message Array CPU Burn

gossip_abuse · active · first seen 2026-01-01

provenance: Reproduced in NullRabbit's attack-reproduction pipeline

mechanism

CVE-2026-49866: gossipsub oversized IHAVE/IWANT control-message arrays (huge messageID lists) → per-ID processing → CPU DoS

instances (1)

chain	primitive	fidelity	origin	reproducer (bundle)	source
libp2p	gossipsub_ihave_iwant_flood	lab	reverse-engineered-cve	gossipsub_ihave_iwant_flood	https://nvd.nist.gov/vuln/detail/CVE-2026-49866 ↗

references

cve: CVE-2026-49866

vendor-advisory: GHPR-Conflux-Chain-conflux-rust-3539

related (gossip_abuse)

NRDAX-T0001 - Addr Message Counter Overflow Crash active NRDAX-T0050 - DHT Sybil Content Censorship active NRDAX-T0120 - Integer-Overflow Panic Control Message active NRDAX-T0192 - Oversized Transaction Block-Fill active NRDAX-T0199 - Peer-Record Flood OOM active NRDAX-T0295 - Sync-State Poisoning Via Fake Blocks active NRDAX-T0312 - Tx-Relay Throughput Jamming active NRDAX-T0326 - Unbounded Peer-Slot Sybil active

cite

https://nrdax.com/techniques/NRDAX-T0188

plain

NRDAX Registry. Technique NRDAX-T0188.

bibtex

@misc{nrdax_NRDAX_T0188,
  title = {Oversized Control-Message Array CPU Burn (NRDAX-T0188)},
  howpublished = {NRDAX Registry},
  url = {https://nrdax.com/techniques/NRDAX-T0188},
}

json (csl)

{
  "id": "nrdax-NRDAX-T0188",
  "type": "dataset",
  "title": "Oversized Control-Message Array CPU Burn (NRDAX-T0188)",
  "URL": "https://nrdax.com/techniques/NRDAX-T0188",
  "publisher": "NRDAX Registry"
}