CVE-2026-46679— libp2p: Memory DoS via subscription flood of unique topics
Possible ATT&CK Techniques 1AI
T1496 · Resource HijackingGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-46679
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
libp2p: Memory DoS via subscription flood of unique topics
Source: NVD (National Vulnerability Database)
Vulnerability Description
libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 15.0.23, three cooperating omissions in @libp2p/gossipsub allow an unauthenticated single peer to exhaust the Node.js heap of any gossipsub node with default options. This issue has been patched in version 15.0.23.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
输入验证不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
libp2p 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
libp2p是libp2p开源的一个模块化点对点网络框架。 libp2p 15.0.23之前版本存在输入验证错误漏洞，该漏洞源于@libp2p/gossipsub中的三个遗漏允许单个未经身份验证的节点耗尽Node.js堆。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-46679
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
Qwen3.6-35B-A3B · 9600 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-46679
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-46679 (1)
IV. Related Vulnerabilities
Same vendor: libp2p
- CVE-2026-45783
libp2p: Unvalidated PUT_VALUE records allow unbounded disk e - CVE-2026-35457
libp2p-rust has unbounded rendezvous DISCOVER cookies enable - CVE-2026-35405
libp2p-rendezvous: Unlimited namespace registrations per pee - CVE-2026-34219
libp2p-gossipsub: Gossipsub PRUNE Backoff Heartbeat Instant - CVE-2026-33040
libp2p-rust: Gossipsub PRUNE.backoff Duration Overflow
Same weakness: CWE-20
- CVE-2026-48774
ProxySQL MCP run_sql_readonly executes side-effecting MySQL - CVE-2026-21768
HCL Verse for Android is susceptible to an injection vulnera - CVE-2026-39998
Apache APISIX: Identity Injection via forward-auth Plugin Mi - CVE-2025-58175
GeoServer has a Server-Side Request Forgery (SSRF) Vulnerabi - CVE-2026-12569
Remote Code Execution (RCE) vulnerability in Windchill PDMli
V. Comments for CVE-2026-46679
No comments yet