Loading...
Skip to main content
GeekWala

CVE-2026-31814 — Vulnerability in yamux — CVE Details

HIGH

Yamux vulnerable to remote Panic via malformed WindowUpdate credit

Published March 13, 2026Updated March 16, 2026Source: osv

Summary

### Sumary The Rust implementation of Yamux accepts `WindowUpdate` credit values from the remote peer and applies them to per-stream send-window state. A specially crafted `WindowUpdate` can cause arithmetic overflow in send-window accounting, which triggers a panic in the connection state machine. This is remotely reachable over a normal network connection and does not require authentication. #### Attack Scenario An attacker that can establish a Yamux session with a target node can crash the target by sending two validly encoded Yamux frames: 1. Open a stream (e.g. DATA + SYN) so the stream exists with initial send-window state (`DEFAULT_CREDIT`). 2. Send a WindowUpdate on that stream with a very large credit value (e.g. 0xFFFF_0000) such that adding credit to the current send-window overflows u32. ### Impact Remote unauthenticated denial of service. An attacker can repeatedly trigger panics by reconnecting and replaying the crafted frame sequence. ### Patches Users should upgrade to `yamux` `v0.13.9` This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Advisory Timeline

  • First published March 13, 2026 (213 days ago).
  • Last revised March 16, 2026 — 3 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Cargo
Update yamux to 0.13.9 or later
cargo update -p yamux --precise 0.13.9

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: crates.io (1).

PackageEcosystemAffectedFixed In
yamux
crates.io
All versions0.13.9

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 7.5 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
—
Confidentiality
—
Integrity
—
Availability
—

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

Frequently Asked Questions

What is CVE-2026-31814?
Yamux vulnerable to remote Panic via malformed WindowUpdate credit This vulnerability has been assigned a severity rating of HIGH (CVSS score: 7.5/10).
How do I check if my project is affected by CVE-2026-31814?
CVE-2026-31814 affects yamux. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-31814 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
7.5

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-4w32-2493-32g7

Related CVEs

  • CVE-2024-32984
    HIGH

    Yamux Memory Exhaustion Vulnerability via Active::pending_frames property

  • CVE-2026-93657
    HIGH

    hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures

  • CVE-2026-18140
    HIGH

    aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers

  • CVE-2026-32314
    HIGH

    Yamux vulnerable to remote Panic via malformed Data frame with SYN set and len = 262145

More crates.io advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies