CVE-2026-32314 Yamux remote Panic via malformed Data frame with SYN set and len = 262145
Remote attackers can crash the application by sending a malformed Yamux data frame, requiring an upgrade to the Rust library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-32314?
CVE-2026-32314 is a high-severity denial of service vulnerability in libp2p rust-yamux, published on 13 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. Prior to 0.13.10, the Rust implementation of Yamux can panic when processing a crafted inbound Data frame that sets SYN and uses a body length greater than DEFAULT_CREDIT (e.g. 262145). On the first packet of a new inbound stream, stream state is created and a receiver is queued before oversized-body validation completes. When validation fails, the temporary stream is dropped and cleanup may call remove(...).expect("stream not found"), triggering a panic in the connection state machine. This is remotely reachable over a normal Yamux session and does not require authentication. This vulnerability is fixed in 0.13.10.
Weakness: CWE-248
Which versions are affected by CVE-2026-32314?
2 open source packages ship an affected version, including yamux. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
yamux crates.io | All versions | 0.13.10 |
yamux crates.io | All versions | 0.13.10 |
Products include Protocol Yamux.
How do I fix CVE-2026-32314?
Upgrade yamux to 0.13.10 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-32314 being exploited?
There is no known exploitation of CVE-2026-32314 in the wild and no public exploit code.
Other vulnerabilities in libp2p rust-yamux
Sources
Also known as DEBIAN-CVE-2026-32314, GHSA-vxx9-2994-q338, UBUNTU-CVE-2026-32314.