libp2p: yamux connection DoS via oversized data frame

SummaryThe yamux stream multiplexer in py-libp2p does not validate incoming DATA frame lengths against the receive window before reading the frame body. Any peer that completes a standard libp2p handshake can send a single 12-byte frame claiming a 4 GB body, causing the victim's yamux read loop t...

PT-2026-80654

Summary The yamux stream multiplexer in py-libp2p does not validate incoming DATA frame lengths against the receive window before reading the frame body. Any peer that completes a standard libp2p handshake can send a single 12-byte frame claiming a 4 GB body, causing the victim's yamux read loop ...

CVE-2026-73568

creationtimestamp| type| source ---|---|--- 2026-08-13 18:35:10+00:00| published-proof-of-concept| https://github.com/libp2p/py-libp2p/security/advisories/GHSA-hmj8-5xmh-5573...

CVE-2026-73568

py-libp2p is the Python implementation of the libp2p networking stack. In 0.7.0 and earlier, the yamux handleincoming method in libp2p/streammuxer/yamux/yamux.py reads an attacker-controlled 32-bit DATA frame length with readexactly before validating it against MAXWINDOWSIZE or checking whether...

CVE-2026-73568 py-libp2p: yamux connection DoS via oversized data frame

py-libp2p is the Python implementation of the libp2p networking stack. In 0.7.0 and earlier, the yamux handleincoming method in libp2p/streammuxer/yamux/yamux.py reads an attacker-controlled 32-bit DATA frame length with readexactly before validating it against MAXWINDOWSIZE or checking whether...

CVE-2026-73568 py-libp2p: yamux connection DoS via oversized data frame

py-libp2p is the Python implementation of the libp2p networking stack. In 0.7.0 and earlier, the yamux handleincoming method in libp2p/streammuxer/yamux/yamux.py reads an attacker-controlled 32-bit DATA frame length with readexactly before validating it against MAXWINDOWSIZE or checking whether...

EUVD-2026-58183

py-libp2p is the Python implementation of the libp2p networking stack. In 0.7.0 and earlier, the yamux handleincoming method in libp2p/streammuxer/yamux/yamux.py reads an attacker-controlled 32-bit DATA frame length with readexactly before validating it against MAXWINDOWSIZE or checking whether...

CVE-2026-73568 py-libp2p: yamux connection DoS via oversized data frame

py-libp2p is the Python implementation of the libp2p networking stack. In 0.7.0 and earlier, the yamux handleincoming method in libp2p/streammuxer/yamux/yamux.py reads an attacker-controlled 32-bit DATA frame length with readexactly before validating it against MAXWINDOWSIZE or checking whether...

CVE-2026-73568

py-libp2p (Python implementation of libp2p) before 0.7.0 has a yamux handle_incoming() flaw in libp2p/stream_muxer/yamux/yamux.py: it reads a 32-bit DATA frame length with read_exactly() before validating against MAX_WINDOW_SIZE or checking stream_id. A peer completing the Noise handshake can sen...

CVE-2026-73568: Uncontrolled Resource Consumption

py-libp2p is the Python implementation of the libp2p networking stack. In 0.7.0 and earlier, the yamux handleincoming method in libp2p/streammuxer/yamux/yamux.py reads an attacker-controlled 32-bit DATA frame length with readexactly before validating it against MAXWINDOWSIZE or checking whether...

PT-2026-71716

Name of the Vulnerable Software and Affected Versions py-libp2p versions 0.7.0 and earlier Description The handle incoming function in the yamux module reads a 32-bit DATA frame length using read exactly before validating it against MAX WINDOW SIZE or verifying the existence of the stream id. A...

GHSA-X8C6-GJ59-6RX8 py-libp2p is vulnerable to DoS attacks through use of large RSA keys

py-libp2p before 0.2.3 allows a peer to cause a denial of service resource consumption via a large RSA key...

py-libp2p is vulnerable to DoS attacks through use of large RSA keys

py-libp2p before 0.2.3 allows a peer to cause a denial of service resource consumption via a large RSA key...

CVE-2025-29606

py-libp2p before 0.2.3 allows a peer to cause a denial of service resource consumption via a large RSA key...

CVE-2025-29606

py-libp2p before 0.2.3 allows a peer to cause a denial of service resource consumption via a large RSA key...

CVE-2025-29606

The CVE-2025-29606 entry impacts the Python libp2p project (py-libp2p) prior to 0.2.3, where a peer can trigger a DoS by sending a very large RSA key. Root cause: insufficient validation of RSA key sizes, leading to resource exhaustion on the target. Affected component/file is the RSA key handlin...

PT-2025-29420

Name of the Vulnerable Software and Affected Versions: py-libp2p versions prior to 0.2.3 Description: py-libp2p versions prior to 0.2.3 are susceptible to a denial of service resource consumption issue. This occurs when a peer sends a large RSA key. Recommendations: Update py-libp2p to version...

CVE-2025-29606

py-libp2p before 0.2.3 allows a peer to cause a denial of service resource consumption via a large RSA key...

CVE-2025-29606: Allocation of Resources Without Limits or Throttling

py-libp2p before 0.2.3 allows a peer to cause a denial of service resource consumption via a large RSA key...

CVE-2025-29606

py-libp2p before 0.2.3 allows a peer to cause a denial of service resource consumption via a large RSA key...