PT-2026-25373 · Yamux · Yamux

Revofusion · Published 2026-01-01 · Updated 2026-03-16 · CVE-2026-32314

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Yamux versions prior to 0.13.10

Description Yamux is a stream multiplexer operating over reliable, ordered connections like TCP/IP. The Rust implementation of Yamux, before version 0.13.10, is susceptible to a panic when processing a specifically crafted inbound Data frame. This frame sets the SYN flag and utilizes a body length exceeding the DEFAULT CREDIT value (for example, 262145). During the initial packet of a new inbound stream, stream state is created and a receiver is queued before the validation of the oversized body completes. If validation fails, the temporary stream is dropped, and the cleanup process may call remove(...).expect("stream not found"), which triggers a panic within the connection state machine. This issue is remotely exploitable through a standard Yamux session without requiring authentication. The vulnerability occurs because stream state is created and a receiver is queued before oversized-body validation is complete.

Recommendations Versions prior to 0.13.10 should be upgraded to version 0.13.10.

Exploit

Fix

Assertion Failure

Weakness Enumeration

CWE-617

CWE-248

Related Identifiers

BDU:2026-04358

CVE-2026-32314

GHSA-VXX9-2994-Q338

Affected Products

Yamux

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32314.json · Exploit
• https://github.com/libp2p/rust-yamux/security/advisories/GHSA-vxx9-2994-q338 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-32314 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32314 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-32314 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vxx9-2994-q338 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32314 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-32314 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-32314 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-04358 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-32314 · Vendor Advisory
• https://github.com/libp2p/rust-yamux · Note
• https://twitter.com/CVEnew/status/2032605879015456976 · Twitter Post