p PatchFirst

CVE-2026-73568

CVE-2026-73568 · py-libp2p: yamux connection DoS via oversized data frame

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

py-libp2p is the Python implementation of the libp2p networking stack. In 0.7.0 and earlier, the yamux handle_incoming() method in libp2p/stream_muxer/yamux/yamux.py reads an attacker-controlled 32-bit DATA frame length with read_exactly() before validating it against MAX_WINDOW_SIZE or checking whether stream_id exists. A peer that completes the standard Noise handshake can send a 12-byte frame declaring a 0xFFFFFFFF body and then withhold the body, causing the sequential yamux read loop used by the default new_host() configuration to block and preventing every stream on that connection from making progress. No fixed version is available as of this review.

CVSS 7.5 · Alta · EPSS 0,5%

Publicación
Actualización

Pila tecnológica: python

Productos y versiones afectados

  • py-libp2p

    Versiones
    • <= 0.7.0: Afectada

    Sin corrección publicada

  • libp2p PyPI

    Versiones
    • 0.1.0a0
    • 0.1.1
    • 0.1.2
    • 0.1.3
    • 0.1.4
    • 0.1.5
    • 0.2.0
    • 0.2.1
    • 0.2.2
    • 0.2.3
    • 0.2.4
    • 0.2.5
    • 0.2.6
    • 0.2.7
    • 0.2.8
    • 0.2.9
    • 0.3.0
    • 0.4.0
    • 0.5.0
    • 0.6.0
    • 0.7.0
    Intervalos de versiones afectados
    • ECOSYSTEM: ≤ 0.7.0

    Sin corrección publicada

Fuentes originales

Comprueba tu servidor →