Author
Ahmed Barakat
Author
Share it
Ethereum News: The Ethereum Foundation’s Protocol Security Group revealed on July 9 that it uses AI agents to analyze the Ethereum codebase known as CVE-2026-34219, an extended vulnerability in the libp2p gossip group that allows any unauthorized peer to compromise another message.
The problem is fixed libp2p-gossipsub v0.49.4and any user who has a compatible client on the previous version should consider the upgrade as non-negotiable.
Find out: The Best Trading Signals
Ethereum News: What the Bug Does
Gossipsub is the peer-to-peer messaging platform that all Ethereum clients rely on to spread blocks and references across the network.
CVE-2026-34219 resides in the PRUNE backoff handler: when a peer sends a PRUNE control message with a minimum value, the implementation executes unchecked. Instant + Duration math on the next signal of the heartbeat. The data overflows and creates panic, according to the SentinelOne security database.
According to NVD CVE profilethe vulnerability has CVSS v3.1 below 8.2 HIGH with network vector, no access required, and user usage.
The attacker can then reconnect and repeat the message after each crash, allowing the denial of service to be repeated at a lower cost. Affected components are validators, indexers, or sidecar tools running Rust libp2p-gossipsub under v0.49.4, the vulnerability is not limited to Ethereum deployments, such as Snyk’s advice disables it as a vulnerability for any software that uses a crate that is vulnerable in the process.
Note: The best crypto to change your profile
How the AI Agent Pipeline Got It
Nikos Baxevanis of the Ethereum Foundation Protocol Security team published the method it discovered.
The team ran multiple AI agents based on Ethereum software, cryptographic code, and contracts, coordinating through a shared Git repository without a central dispatcher, a design borrowed from Anthropic’s shipbuilding project.
Responsibilities were created as hard as the work came to them: Recon turned the attack site into testable ideas, Search followed the code and refactoring process, Gap filling, and Validation independently reviewed before anyone read it.
The main punishment was the strict limits of reproduction. As the EF post says: “A candidate can’t be found until there’s an automated thing that causes a failure against real code, and it’s run by someone who didn’t write it.”
That single rule filtered out the common pitfalls of fakery – fears that went wrong in construction, developers who relied on internals that no real attacker could extract, and testimonials that were partially satisfied regardless of actual performance.
A clear description of the EF group is a very useful part of the disclosure process. “What was surprising was how little work it took to find them, and how much it led to distinguishing real bugs from seemingly real ones,” Baxevanis wrote.
Many of the candidates were incorrect, duplicated, or incomplete, and the volume the AI produces means that false positives are generated quickly without testing tools.
What This Means for Protocol Security Moving Forward
CVE-2026-34219 is not a known issue in the libp2p configuration. According to the external CVE list, an earlier vulnerability, CVE-2026-33040, reportedly affected the PRUNE/backoff overflow implemented in v0.49.3 and CVSS 8.7. CVE-2026-33040 and CVE-2026-34219 appear to be back-to-back bugs in the same path in successive small steps, showing a systematic hardening of libp2p’s control instead of a single patch, and showing continued gossip presentations.
What defines most of Ethereum’s infrastructure is stability. AI-powered security services have been used in intelligence monitoring for years; This disclosure shows the necessary changes based on the same technology against the network and code.
The conclusion of the EF group is specific: “The obstacles did not go away. They went from finding errors to relying on results, which is a better place, because that is where human judgment is important.” About Ethereum price historyit’s a long-term fix – not just a one-time find.
Users of the compatible client or any other tool built on Rust libp2p should verify their version of gossipsub immediately and upgrade to v0.49.4 or later. The patch adds a limit to the length of time checking in PRUNE messages before entering the arithmetic heartbeat, closing the overflow method completely.
Don’t miss our $1,000 USDT Airdrop on ByBit
