CVE-2026-46679CWE-20CWE-400CWE-401

libp2p: Memory DoS via subscription flood of unique topics

High · published June 10, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
38.9
In the wild
Unconfirmed
What it is

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 15.0.23, three cooperating omissions in @libp2p/gossipsub allow an unauthenticated single peer to exhaust the Node.js heap of any gossipsub node with default options. This issue has been patched in version 15.0.23.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00460 · 38.9th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-400 · Uncontrolled Resource Consumption; CWE-401 · Missing Release of Memory after Effective Lifetime
Published
2026-06-10T21:08Z
EPSS history
Timeline
  • 10 JUN 21:08Z
    libp2p: Memory DoS via subscription flood of unique topics
    cvelistv5