The yamux multiplexer in py-libp2p versions up to 0.6.0 fails to check that the length field of incoming DATA frames fits within the configured receive window before reading the frame body. The length field is a 32-bit unsigned integer, allowing an attacker to specify a frame body size up to 4,294,967,295 bytes. The code reads the frame body unconditionally and sequentially without timeout, causing the read loop to block indefinitely when the data does not arrive. This blocks processing of subsequent frames and stalls all streams on the connection. The vulnerability affects the default new_host() configuration and requires no special privileges. The yamux specification mandates resetting streams that exceed receive window limits, but py-libp2p does not enforce this, unlike other implementations. A proof-of-concept demonstrates that sending a crafted frame causes the victim's yamux connection to deadlock, preventing new streams from opening.

Successful exploitation results in a denial-of-service condition on the yamux connection, blocking all streams multiplexed over that connection. The victim's read loop stalls indefinitely, preventing any further communication on the affected connection. This does not lead to code execution or data corruption but causes availability loss of the libp2p streams on that connection.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling yamux or applying custom validation of frame lengths if possible. Monitoring for unusually large frame length values and implementing timeouts around frame reads could mitigate impact. No official patch or workaround is documented in the provided data.