GHSA-HMJ8-5XMH-5573: Connection Denial of Service via Oversized DATA Frame in py-libp2p
Vulnerability ID: GHSA-HMJ8-5XMH-5573
CVSS Score: 7.5
Published: 2026-07-24
A critical connection-level Denial of Service (DoS) vulnerability exists in the Yamux stream multiplexer implementation of py-libp2p (versions <= 0.6.0). The flaw allows unauthenticated or authenticated peers to permanently stall a Yamux multiplexed connection by transmitting a single malformed 12-byte header claiming an oversized payload while withholding the payload bytes.
TL;DR
Unauthenticated remote attackers can permanently freeze py-libp2p connections using a single 12-byte Yamux frame header claiming a 4 GB payload without sending the data, triggering an indefinite read block.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-400
- Attack Vector: Network (AV:N)
- CVSS Score: 7.5 (High)
- Exploit Status: PoC (Proof of Concept)
- KEV Status: Not Listed
- Impact: Denial of Service (DoS)
Affected Systems
- py-libp2p
- libp2p
-
py-libp2p: <= 0.6.0 (Fixed in:
commit 146ea87)
Code Analysis
Commit: 146ea87
Implement flow control bounds checks and trio cancellation timeout boundaries on Yamux DATA frames
Exploit Details
- GitHub Security Advisory: Vulnerability report and discussion of the Yamux connection stall
Mitigation Strategies
- Apply validation bounds on the DATA frame length field in Yamux to enforce limit boundaries
- Implement frame read timeout boundaries using asynchronous cancellation scopes
- Enforce network socket connection timeouts
Remediation Steps:
- Incorporate the upstream security patch 146ea87d1a20cc7dacf684ecf7c204543be04b37 into your py-libp2p package build
- Configure the dynamic PY_YAMUX_DATA_READ_TIMEOUT environment variable to limit the maximum read time
- Monitor connection logs for warnings indicating oversized DATA frame announcements or TooSlowError exceptions
References
Read the full report for GHSA-HMJ8-5XMH-5573 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)