CVE-2026-73568High· 7.5▾ Twilightpy-libp2p is the Python implementation of the libp2p networking stack. In 0.7.0 and earlier, the yamux handle_incoming() method in libp2p/stream_muxer/yamux/yamux.py reads an attacker-controlled 32-bit DATA frame length with read_exactly…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Last analysed / modified upstream
0.4% → 0.4%
py-libp2p is the Python implementation of the libp2p networking stack. In 0.7.0 and earlier, the yamux handle_incoming() method in libp2p/stream_muxer/yamux/yamux.py reads an attacker-controlled 32-bit DATA frame length with read_exactly() before validating it against MAX_WINDOW_SIZE or checking whether stream_id exists. A peer that completes the standard Noise handshake can send a 12-byte frame declaring a 0xFFFFFFFF body and then withhold the body, causing the sequential yamux read loop used by the default new_host() configuration to block and preventing every stream on that connection from making progress. No fixed version is available as of this review.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
libp2p <= 0.7.0Connected by shared product, vendor, weakness, or advisory.
GHSA-hmj8-5xmh-5573High· 7.5libp2p: yamux connection DoS via oversized data frame
CVE-2025-29606Medium· 4.3py-libp2p is vulnerable to DoS attacks through use of large RSA keys
CVE-2026-86040High· 7.5libp2p is a JavaScript implementation of the libp2p networking stack
CVE-2026-49866High· 7.5libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays
CVE-2026-33625High· 8.8LMDeploy is a toolkit for compressing, deploying, and serving large language models
CVE-2026-61544High· 8.2libp2p-rust is the official Rust language implementation of the libp2p networking stack