{"uuid": "be117cb9-f41d-4a66-b16e-7c472f8c065f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-hmj8-5xmh-5573", "type": "seen", "source": "https://gist.github.com/alon710/610364d1088c3e73d54d1422be1a22f2", "content": "# GHSA-HMJ8-5XMH-5573: GHSA-HMJ8-5XMH-5573: Connection Denial of Service via Oversized DATA Frame in py-libp2p\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-07-24\n> **Full Report:** https://cvereports.com/reports/GHSA-HMJ8-5XMH-5573\n\n## Summary\nA critical connection-level Denial of Service (DoS) vulnerability exists in the Yamux stream multiplexer implementation of py-libp2p (versions <= 0.6.0). The flaw allows unauthenticated or authenticated peers to permanently stall a Yamux multiplexed connection by transmitting a single malformed 12-byte header claiming an oversized payload while withholding the payload bytes.\n\n## TL;DR\nUnauthenticated remote attackers can permanently freeze py-libp2p connections using a single 12-byte Yamux frame header claiming a 4 GB payload without sending the data, triggering an indefinite read block.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 7.5 (High)\n- **Exploit Status**: PoC (Proof of Concept)\n- **KEV Status**: Not Listed\n- **Impact**: Denial of Service (DoS)\n\n## Affected Systems\n\n- py-libp2p\n- libp2p\n- **py-libp2p**: <= 0.6.0 (Fixed in: `commit 146ea87`)\n\n## Mitigation\n\n- Apply validation bounds on the DATA frame length field in Yamux to enforce limit boundaries\n- Implement frame read timeout boundaries using asynchronous cancellation scopes\n- Enforce network socket connection timeouts\n\n**Remediation Steps:**\n1. Incorporate the upstream security patch 146ea87d1a20cc7dacf684ecf7c204543be04b37 into your py-libp2p package build\n2. Configure the dynamic PY_YAMUX_DATA_READ_TIMEOUT environment variable to limit the maximum read time\n3. Monitor connection logs for warnings indicating oversized DATA frame announcements or TooSlowError exceptions\n\n## References\n\n- [GitHub Security Advisory GHSA-HMJ8-5XMH-5573](https://github.com/advisories/GHSA-HMJ8-5XMH-5573)\n- [libp2p Security Advisory](https://github.com/libp2p/py-libp2p/security/advisories/GHSA-hmj8-5xmh-5573)\n- [Fix Commit](https://github.com/libp2p/py-libp2p/commit/146ea87d1a20cc7dacf684ecf7c204543be04b37)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-HMJ8-5XMH-5573) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-25T05:31:39.963550Z"}