{"id":"CVE-2026-46679","sourceIdentifier":"security-advisories@github.com","published":"2026-06-10T22:17:00.300","lastModified":"2026-07-23T09:10:00.113","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 15.0.23, three cooperating omissions in @libp2p/gossipsub allow an unauthenticated single peer to exhaust the Node.js heap of any gossipsub node with default options. This issue has been patched in version 15.0.23."},{"lang":"es","value":"libp2p es una implementación de JavaScript de la pila de red libp2p. Antes de la versión 15.0.23, tres omisiones combinadas en @libp2p/gossipsub permiten que un único par no autenticado agote la memoria heap de Node.js de cualquier nodo gossipsub con las opciones predeterminadas. Este problema ha sido parcheado en la versión 15.0.23."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"libp2p","product":"js-libp2p","versions":[{"version":"< 15.0.23","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-06-11T14:18:10.380346Z","id":"CVE-2026-46679","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-401"}]}],"references":[{"url":"https://github.com/libp2p/js-libp2p/security/advisories/GHSA-4f8r-922h-2vgv","source":"security-advisories@github.com"},{"url":"https://github.com/libp2p/js-libp2p/security/advisories/GHSA-4f8r-922h-2vgv","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}