VulnerabilityPublished 07/24/2026

libp2p: yamux connection DoS via oversized data frame

Affects libp2pSource GCVE Database

CVSS 3.1 base score

7.5High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What to do

AI-suggested

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling yamux or applying custom validation of frame lengths if possible. Monitoring for unusually large frame length values and implementing timeouts around frame reads could mitigate impact. No official patch or workaround is documented in the provided data.

Affected software

Product	Affected	Fixed in
PyPIlibp2p	Affected <=0.6.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

A denial-of-service vulnerability exists in the yamux stream multiplexer implementation of py-libp2p (<=0.6.0). The vulnerability arises because the code does not validate incoming DATA frame lengths against the receive window before reading the frame body. An attacker can send a single frame claiming a very large body (up to 4 GB), causing the victim's yamux read loop to block indefinitely and stall all streams on that connection. This requires no special setup beyond completing a standard libp2p handshake.

Summary

The yamux multiplexer in py-libp2p versions up to 0.6.0 fails to check that the length field of incoming DATA frames fits within the configured receive window before reading the frame body. The length field is a 32-bit unsigned integer, allowing an attacker to specify a frame body size up to 4,294,967,295 bytes. The code reads the frame body unconditionally and sequentially without timeout, causing the read loop to block indefinitely when the data does not arrive. This blocks processing of subsequent frames and stalls all streams on the connection. The vulnerability affects the default new_host() configuration and requires no special privileges. The yamux specification mandates resetting streams that exceed receive window limits, but py-libp2p does not enforce this, unlike other implementations. A proof-of-concept demonstrates that sending a crafted frame causes the victim's yamux connection to deadlock, preventing new streams from opening.

Impact

Successful exploitation results in a denial-of-service condition on the yamux connection, blocking all streams multiplexed over that connection. The victim's read loop stalls indefinitely, preventing any further communication on the affected connection. This does not lead to code execution or data corruption but causes availability loss of the libp2p streams on that connection.

Weaknesses

CWE-400Uncontrolled Resource Consumption (opens in a new tab)

What to do

Affected software

Description

AnalysisAI-generated, updated 07/25/2026, 23:49:01 UTC

Technical details

Weaknesses

References

Related threats