CVE-2026-31814

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31814", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-09T16:33:42.914Z", "datePublished": "2026-03-13T19:19:41.879Z", "dateUpdated": "2026-03-13T19:38:02.290Z"}, "containers": {"cna": {"title": "Yamux remote Panic via malformed WindowUpdate credit", "problemTypes": [{"descriptions": [{"cweId": "CWE-190", "lang": "en", "description": "CWE-190: Integer Overflow or Wraparound", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/libp2p/rust-yamux/security/advisories/GHSA-4w32-2493-32g7", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/libp2p/rust-yamux/security/advisories/GHSA-4w32-2493-32g7"}], "affected": [{"vendor": "libp2p", "product": "rust-yamux", "versions": [{"version": ">= 0.13.0, < 0.13.9", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-13T19:19:41.879Z"}, "descriptions": [{"lang": "en", "value": "Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. From 0.13.0 to before 0.13.9, a specially crafted WindowUpdate can cause arithmetic overflow in send-window accounting, which triggers a panic in the connection state machine. This is remotely reachable over a normal network connection and does not require authentication. This vulnerability is fixed in 0.13.9."}], "source": {"advisory": "GHSA-4w32-2493-32g7", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-13T19:37:53.480882Z", "id": "CVE-2026-31814", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T19:38:02.290Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31814", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-13T19:37:53.480882Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T19:37:58.086Z"}}], "cna": {"title": "Yamux remote Panic via malformed WindowUpdate credit", "source": {"advisory": "GHSA-4w32-2493-32g7", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "libp2p", "product": "rust-yamux", "versions": [{"status": "affected", "version": ">= 0.13.0, < 0.13.9"}]}], "references": [{"url": "https://github.com/libp2p/rust-yamux/security/advisories/GHSA-4w32-2493-32g7", "name": "https://github.com/libp2p/rust-yamux/security/advisories/GHSA-4w32-2493-32g7", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. From 0.13.0 to before 0.13.9, a specially crafted WindowUpdate can cause arithmetic overflow in send-window accounting, which triggers a panic in the connection state machine. This is remotely reachable over a normal network connection and does not require authentication. This vulnerability is fixed in 0.13.9."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190: Integer Overflow or Wraparound"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-13T19:19:41.879Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31814", "state": "PUBLISHED", "dateUpdated": "2026-03-13T19:38:02.290Z", "dateReserved": "2026-03-09T16:33:42.914Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-13T19:19:41.879Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "rust-yamux", "vendor": "libp2p", "versions": [{"status": "affected", "version": ">= 0.13.0, < 0.13.9"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:protocol:yamux:*:*:*:*:*:rust:*:*", "matchCriteriaId": "86BA699D-3FED-46FB-943E-FCB96C23DDBB", "versionEndExcluding": "0.13.9", "versionStartIncluding": "0.13.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. From 0.13.0 to before 0.13.9, a specially crafted WindowUpdate can cause arithmetic overflow in send-window accounting, which triggers a panic in the connection state machine. This is remotely reachable over a normal network connection and does not require authentication. This vulnerability is fixed in 0.13.9."}, {"lang": "es", "value": "Yamux es un multiplexor de flujo sobre conexiones fiables y ordenadas como TCP/IP. Desde 0.13.0 hasta antes de 0.13.9, una WindowUpdate especialmente dise\u00f1ada puede causar un desbordamiento aritm\u00e9tico en la contabilidad de la ventana de env\u00edo, lo que desencadena un p\u00e1nico en la m\u00e1quina de estados de la conexi\u00f3n. Esto es alcanzable remotamente a trav\u00e9s de una conexi\u00f3n de red normal y no requiere autenticaci\u00f3n. Esta vulnerabilidad est\u00e1 corregida en 0.13.9."}], "id": "CVE-2026-31814", "lastModified": "2026-06-17T10:34:30.497", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31814", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-13T19:37:53.480882Z", "version": "2.0.3"}}]}, "published": "2026-03-13T19:54:36.470", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/libp2p/rust-yamux/security/advisories/GHSA-4w32-2493-32g7"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.13.0,0.13.9)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "rust-yamux", "source": "cna", "vendor": "libp2p"}, "product": "rust-yamux", "vendor": "libp2p"}], "analysis": {"en": {"generated_at": "2026-03-19T16:06:57.193893+00:00", "value": {"mitigation_remediation": ["Update libp2p:rust-yamux to version 0.13.9 or later; this release fixes the arithmetic overflow in WindowUpdate handling.", "If an immediate upgrade is not feasible, isolate the affected services behind a firewall or network filter that rejects or drops malformed WindowUpdate packets, and monitor for suspicious traffic patterns."], "summary": {"action": "Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the libp2p:rust-yamux package versions ranging from 0.13.0 up to but not including 0.13.9. The specific CPE identifier is cpe:2.3:a:protocol:yamux:*:*:*:*:*:rust:*:*.", "description_and_impact": "Yamux, a stream multiplexer built over TCP/IP, has a flaw in sending window accounting that can be triggered by a specially crafted WindowUpdate packet. The arithmetic overflow causes a panic in the connection state machine, resulting in a crash of the affected process. This vulnerability is exploitable remotely via a normal network connection and does not require authentication, leading to a denial of service for any application using the vulnerable library.", "risk_and_exploitability": "The CVSS score of 8.7 classifies this as a high severity issue. The EPSS score of less than 1% indicates a low overall probability of exploitation, and the vendor has not listed it in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires only the ability to send a maliciously crafted WindowUpdate over a network connection to the target. Successful exploitation results in a program crash, causing denial of service for the affected process and potentially impacting connected peers. The vulnerability is exploitable without credentials and can be delivered over any active TCP/IP session that uses Yamux."}}}}, "created": "2026-03-16T09:24:20.106798+00:00", "updated": "2026-03-23T13:40:14.861835+00:00", "vendors": ["libp2p", "libp2p$PRODUCT$rust-yamux"]}