GHSA-vxx9-2994-q338

Source

https://github.com/advisories/GHSA-vxx9-2994-q338

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-vxx9-2994-q338/GHSA-vxx9-2994-q338.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-vxx9-2994-q338

Aliases

CVE-2026-32314

Published

2026-03-13T20:04:38Z

Modified

2026-03-16T22:16:17Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Yamux vulnerable to remote Panic via malformed Data frame with SYN set and len = 262145

Details

Summary

The Rust implementation of Yamux can panic when processing a crafted inbound Data frame that sets SYN and uses a body length greater than DEFAULT_CREDIT (e.g. 262145). On the first packet of a new inbound stream, stream state is created and a receiver is queued before oversized-body validation completes. When validation fails, the temporary stream is dropped and cleanup may call remove(...).expect("stream not found"), triggering a panic in the connection state machine. This is remotely reachable over a normal Yamux session and does not require authentication. kind of vulnerability is it? Who is

Attack Scenario

An attacker that can establish a Yamux session with a target node can crash the target by sending a single validly encoded Yamux Data|SYN frame with an oversized body:

Establish a standard authenticated transport session that negotiates Yamux.
Send one Yamux frame with:
- Tag = Data
- Flags = SYN
- StreamId = 1 (or any new inbound stream id)
- Length = DEFAULT_CREDIT + 1 (e.g. 262145)
- Body of matching size This can trigger a panic (stream not found) and terminate the process, depending on host application panic policy.

Patches

Users should upgrade to yamux v0.13.10

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Database specific

{
    "cwe_ids":  [
        "CWE-248",
        "CWE-617"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-13T20:04:38Z",
    "nvd_published_at":  "2026-03-16T14:19:34Z",
    "severity":  "HIGH"
}

References

Affected packages

crates.io / yamux

Package

Name: yamux; View open source insights on deps.dev
Purl: pkg:cargo/yamux

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.13.10

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-vxx9-2994-q338/GHSA-vxx9-2994-q338.json"