CVE-2026-73568
Received Received - Intake

Yamux Stream Blocking in py-libp2p

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description
py-libp2p is the Python implementation of the libp2p networking stack. In 0.7.0 and earlier, the yamux handle_incoming() method in libp2p/stream_muxer/yamux/yamux.py reads an attacker-controlled 32-bit DATA frame length with read_exactly() before validating it against MAX_WINDOW_SIZE or checking whether stream_id exists. A peer that completes the standard Noise handshake can send a 12-byte frame declaring a 0xFFFFFFFF body and then withhold the body, causing the sequential yamux read loop used by the default new_host() configuration to block and preventing every stream on that connection from making progress. No fixed version is available as of this review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-73568
EUVD
EUVD-2026-58183

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
libp2p py_libp2p to 0.7.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a denial-of-service vulnerability in the py-libp2p library affecting the yamux stream multiplexer. An attacker can send a maliciously crafted DATA frame with an oversized length claim (up to 4 GB) without sending the actual data. This causes the victim's yamux read loop to block indefinitely, freezing all streams on the affected connection.

Detection Guidance

Monitor for blocked or hung yamux connections where streams stop progressing. Check for peers sending oversized DATA frames (e.g., 0xFFFFFFFF length) or withholding frame bodies. Inspect logs for connection timeouts or unresponsive streams in py-libp2p applications.

Impact Analysis

If exploited, this vulnerability can cause all network streams on a yamux connection to become unresponsive, leading to a complete denial of service. The attack requires only a standard Noise handshake and no special setup, making it easy to execute by any authenticated peer.

Mitigation Strategies

Upgrade to a patched version if available. If not, implement receive window validation and per-frame timeouts in yamux handle_incoming(). Block or isolate peers exhibiting suspicious behavior (e.g., sending oversized frames). Monitor connections for indefinite blocking.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73568. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart