{"id":"CVE-2026-73568","title":"py-libp2p is the Python implementation of the libp2p networking stack","summary":"py-libp2p is the Python implementation of the libp2p networking stack. In 0.7.0 and earlier, the yamux handle_incoming() method in libp2p/stream_muxer/yamux/yamux.py reads an attacker-controlled 32-bit DATA frame length with read_exactly…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-400"],"vendor":"libp2p","product":"libp2p","affected":["libp2p <= 0.7.0"],"published":"2026-08-13","updated":"2026-09-18","sourceUpdated":"2026-09-18T20:09:01.757","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73568","references":[{"url":"https://github.com/libp2p/py-libp2p/commit/146ea87d1a20cc7dacf684ecf7c204543be04b37","label":"security-advisories@github.com"},{"url":"https://github.com/libp2p/py-libp2p/security/advisories/GHSA-hmj8-5xmh-5573","label":"security-advisories@github.com"},{"url":"https://github.com/libp2p/py-libp2p/security/advisories/GHSA-hmj8-5xmh-5573","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/libp2p/py-libp2p"}],"tags":["nvd","osv","pip"],"epss":0.00415,"epssPercentile":0.35378,"aliases":["GHSA-hmj8-5xmh-5573"],"ecosystem":"pip","ingestedAt":"2026-08-13T19:18:20.712Z","slug":"CVE-2026-73568","body":"## Overview\n\npy-libp2p is the Python implementation of the libp2p networking stack. In 0.7.0 and earlier, the yamux handle_incoming() method in libp2p/stream_muxer/yamux/yamux.py reads an attacker-controlled 32-bit DATA frame length with read_exactly() before validating it against MAX_WINDOW_SIZE or checking whether stream_id exists. A peer that completes the standard Noise handshake can send a 12-byte frame declaring a 0xFFFFFFFF body and then withhold the body, causing the sequential yamux read loop used by the default new_host() configuration to block and preventing every stream on that connection from making progress. No fixed version is available as of this review.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-73568)\n\nAffected packages:\n\n- `libp2p <= 0.7.0`\n\nSource: https://osv.dev/vulnerability/GHSA-hmj8-5xmh-5573","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}