CVE-2026-31814 Yamux remote Panic via malformed WindowUpdate credit
A remote attacker can cause a denial of service in the Yamux library by sending a malformed WindowUpdate message that triggers an arithmetic overflow and panic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31814?
CVE-2026-31814 is a high-severity vulnerability in libp2p rust-yamux, published on 13 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. From 0.13.0 to before 0.13.9, a specially crafted WindowUpdate can cause arithmetic overflow in send-window accounting, which triggers a panic in the connection state machine. This is remotely reachable over a normal network connection and does not require authentication. This vulnerability is fixed in 0.13.9.
Weakness: CWE-190
Which versions are affected by CVE-2026-31814?
2 open source packages ship an affected version, including yamux. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
yamux crates.io | From 0.13.0 | 0.13.9 |
yamux crates.io | From 0.13.0 | 0.13.9 |
Products include Protocol Yamux.
How do I fix CVE-2026-31814?
Upgrade yamux to 0.13.9 or later.
Is CVE-2026-31814 being exploited?
There is no known exploitation of CVE-2026-31814 in the wild and no public exploit code.
Other vulnerabilities in libp2p rust-yamux
Sources
Also known as DEBIAN-CVE-2026-31814, GHSA-4w32-2493-32g7, UBUNTU-CVE-2026-31814.