CVE-2026-73568

py-libp2p yamux vulnerable to DoS via unvalidated large frame length.

• CVSS 7.5
• 400
• Resource Management
• Remote

py-libp2p is the Python implementation of the libp2p networking stack. In 0.7.0 and earlier, the yamux handle_incoming() method in libp2p/stream_muxer/yamux/yamux.py reads an attacker-controlled 32-bit DATA frame length with read_exactly() before validating it against MAX_WINDOW_SIZE or checking whether stream_id exists. A peer that completes the standard Noise handshake can send a 12-byte frame declaring a 0xFFFFFFFF body and then withhold the body, causing the sequential yamux read loop used by the default new_host() configuration to block and preventing every stream on that connection from making progress. No fixed version is available as of this review.

CVE

CVE-2026-73568

CWE

400

CVSS base score

7.5

Published

2026-08-13

OWASP

A04 Insecure Design

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Resource Management

Subcategory

Resource Exhaustion

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Affected component

py-libp2p

Fixed by upgrading

Yes

Solution

As of this advisory, no patched version of py-libp2p is available. Users should monitor the project's official repository for a fix.

from typing import NamedTuple, Protocol

HEADER_LEN = 12
MAX_WINDOW_SIZE = 16 * 1024 * 1024


class YamuxError(Exception):
    pass


class IConn(Protocol):
    async def read_exactly(self, n: int) -> bytes: ...


class Header(NamedTuple):
    length: int

    @classmethod
    def decode(cls, data: bytes) -> "Header":
        return cls(length=int.from_bytes(data[8:12], "big"))


class Yamux:
    def __init__(self, conn: IConn) -> None:
        self.conn = conn

    async def handle_incoming(self) -> bytes:
        header = Header.decode(await self.conn.read_exactly(HEADER_LEN))
        # VULNERABLE: attacker-controlled 32-bit body length read before validation
        body = await self.conn.read_exactly(header.length)
        return body

from typing import NamedTuple, Protocol

HEADER_LEN = 12
MAX_WINDOW_SIZE = 16 * 1024 * 1024


class YamuxError(Exception):
    pass


class IConn(Protocol):
    async def read_exactly(self, n: int) -> bytes: ...


class Header(NamedTuple):
    length: int

    @classmethod
    def decode(cls, data: bytes) -> "Header":
        return cls(length=int.from_bytes(data[8:12], "big"))


class Yamux:
    def __init__(self, conn: IConn) -> None:
        self.conn = conn

    async def handle_incoming(self) -> bytes:
        header = Header.decode(await self.conn.read_exactly(HEADER_LEN))
        # FIX: reject oversized body length against MAX_WINDOW_SIZE before reading
        if header.length > MAX_WINDOW_SIZE:
            raise YamuxError("frame body length exceeds MAX_WINDOW_SIZE")
        body = await self.conn.read_exactly(header.length)
        return body

b'\x00\x00\x00\x00\x00\x00\x00\x01\xff\xff\xff\xff'

@misc{vaitp:cve202673568,
  title        = {{py-libp2p yamux vulnerable to DoS via unvalidated large frame length.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-73568},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-73568/}}
}