py-libp2p CVE-2026-73568

The victim must run py-libp2p version 0.7.0 or earlier using the default new_host() yamux configuration - no non-default setup is required on either side. The attacker must be able to reach the target's libp2p listening address and complete a standard Noise handshake, which is the normal prerequisite for any peer-to-peer communication in the libp2p ecosystem; CVSS PR:N confirms no authentication beyond this handshake is required. Exploitation is bounded to denial-of-service on the targeted yamux connection and all streams within it - it does not grant code execution or data access (CVSS C:N/I:N). Other connections on the same host process are not directly stalled by a single attack frame, though an adversary can open multiple connections to amplify impact. There is no user interaction requirement.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) accurately represents this vulnerability: the only prerequisite is completing the standard Noise handshake, which is the normal connection setup for any libp2p node, so attack complexity is genuinely low with no authentication barrier. No EPSS data was supplied in the input, so a numerical exploitation probability cannot be stated; however, the trivial exploit mechanics and a documented proof-of-concept in the GHSA advisory confirm this is not a high-CVSS/low-real-risk case. KEV status is not confirmed, so active exploitation in the wild cannot be asserted - the exploitation status is 'publicly available exploit code exists' based on the PoC in the advisory. The absence of a released patched version extends the exposure window, as operators must manually apply the upstream commit. The per-connection scope of the DoS (CVSS S:U) slightly limits blast radius compared to a process-level crash, but an attacker controlling multiple connections could amplify impact. The risk is meaningful for any py-libp2p node accepting inbound connections from untrusted peers.

An attacker operates a libp2p node and initiates a standard connection to the target py-libp2p host, completing the Noise handshake normally - an operation indistinguishable from legitimate peer behavior. The attacker then writes a single 12-byte yamux DATA frame with the length field set to 0xFFFFFFFF (4,294,967,295 bytes) and withholds all body bytes. The victim's handle_incoming() loop suspends indefinitely inside read_exactly(), and every stream multiplexed over that yamux connection becomes permanently unresponsive; a proof-of-concept demonstrating this exact sequence is documented in the GHSA advisory.