CVE-2026-31814highCWE-190

CVE-2026-31814: falha de alta gravidade em libp2p rust-yamux

Yamux remote Panic via malformed WindowUpdate credit

Publicada em

Seguir esta CVE+ Monitorar rust-yamux+ Monitorar yamux

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 0.5%
Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. From 0.13.0 to before 0.13.9, a specially crafted WindowUpdate can cause arithmetic overflow in send-window accounting, which triggers a panic in the connection state machine. This is remotely reachable over a normal network connection and does not require authentication. This vulnerability is fixed in 0.13.9.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
libp2p · rust-yamux
CVEs relacionadas — libp2p rust-yamux

No mesmo produto, das mais perigosas para as menos.

CVE-2024-32984HIGHYamux Memory Exhaustion Vulnerability via Active::pending_frames property EPSS 0.8%CVE-2026-32314HIGHYamux remote Panic via malformed Data frame with SYN set and len = 262145EPSS 0.5%