EUVD-2026-12095
GHSA-vxx9-2994-q338
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted Yamux Data frame
-
DeliverySet SYN flag with oversized body
-
ExploitTrigger stream state creation
-
ExecutionValidation fails during cleanup
-
ImpactCall remove().expect() panic
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Exception handling completeness
|
| Exploitation Conditions | Yamux library versions prior to 0.13.10 must be deployed. Remote attacker sends malformed Yamux Data frame with SYN flag and body length exceeding DEFAULT_CREDIT (262145 bytes) on any TCP connection using Yamux multiplexing. |
| Impact | Despite the high CVSS 4.0 score of 8.7 (driven by network attack vector, low complexity, no authentication required, and high availability impact), the real-world risk appears moderate based on available signals. The EPSS score is not provided, suggesting lower exploitation likelihood. The vulnerability is not listed in CISA KEV, indicating no known active exploitation. No public proof-of-concept code is mentioned in the available data. The SSVC decision framework would likely categorize this as 'Track' rather than 'Immediate' given the lack of exploitation evidence and the fact that impact is limited to availability (no confidentiality or integrity compromise). This appears to be a classic high-CVSS-but-moderate-real-risk scenario where theoretical severity exceeds practical threat level. |
| Exploit ScenarioDerived | An attacker identifies a service using the vulnerable Yamux library exposed to the network, then sends a specially crafted Data frame with the SYN flag set and a body length of 262145 bytes or greater to trigger the panic condition. This causes immediate termination of the connection handler thread or process, resulting in service disruption for all users sharing that connection context. The attack requires no authentication and can be automated to repeatedly crash the service. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 13, 2026
Rust Yamux prior to version 0.13.10 is vulnerable to denial of service when processing specially crafted inbound stream frames that combine the SYN flag with oversized body lengths, causing the connection handler to panic due to improper state cleanup. An unauthenticated remote attacker can trigger this panic over any normal Yamux session without special privileges, crashing affected applications. No patch is currently available for this high-severity vulnerability.
Earlier versions of this analysis (1)
A denial of service vulnerability exists in the Rust implementation of Yamux stream multiplexer where a remote attacker can trigger a panic by sending a specially crafted Data frame with specific flags and oversized body length. The vulnerability affects Yamux versions prior to 0.13.10 and allows unauthenticated attackers to crash applications using this library over network connections. While no public exploits or active exploitation have been reported, the vulnerability has a high CVSS score of 8.7 due to its remote, unauthenticated nature and ability to cause service disruption.
RemediationAI
The primary remediation is to upgrade the Yamux Rust library to version 0.13.10 or later, which contains the fix for this vulnerability. Development teams should update their Cargo.toml dependencies to specify yamux = "0.13.10" or higher and rebuild affected applications. As a temporary mitigation, consider implementing connection rate limiting and monitoring for unusual connection patterns that could indicate exploitation attempts. Network segmentation to limit exposure of services using Yamux to untrusted networks can also reduce attack surface until patching is complete.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in cargo, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Yamux is a stream multiplexing protocol library that enables multiple logical streams over a single reliable connection like TCP/IP, commonly used in peer-to-peer and distributed systems. The vulnerability stems from improper error handling (CWE-248) in the Rust implementation where the code fails to properly validate oversized Data frames before creating stream state. When an inbound Data frame sets the SYN flag and includes a body length exceeding DEFAULT_CREDIT (262145 bytes), the implementation creates temporary stream state and queues a receiver before completing validation. When validation subsequently fails, cleanup code calls remove().expect() on a stream that was never fully established, causing a panic in the connection state machine.
Know when Rust gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. Prior to 0.13.10, the Rust implementation of Yamux can panic when processing a crafted inbound Data frame that sets SYN and uses a body length greater than DEFAULT_CREDIT (e.g. 262145). On the first packet of a new inbound stream, stream state is created and a receiver is queued before oversized-body validation completes. When validation fails, the temporary stream is dropped and cleanup may call remove(...).expect("stream not found"), triggering a panic in the connection state machine. This is remotely reachable over a normal Yamux session and does not require authentication. This vulnerability is fixed in 0.13.10.
Executive ViewAI
A remotely exploitable vulnerability in Yamux stream multiplexer (CVE-2026-32314) can crash applications without authentication, potentially disrupting services that rely on this library for TCP/IP communication. Organizations using Yamux versions prior to 0.13.10 face denial-of-service risk and should immediately inventory affected systems.
Until patch 0.13.10 is released and deployed: (1) Implement network segmentation and firewall rules to restrict inbound connections to Yamux services to trusted IP ranges only; (2) Deploy WAF or IDS/IPS rules to detect and block malformed Yamux Data frames with SYN flag and oversized bodies; (3) Monitor application logs for unexpected crashes or connection state machine errors; (4) Consider disabling Yamux-dependent features if operationally feasible; (5) Establish incident response procedures for rapid service restart if crashes occur.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Command injection via Windows CreateProcess argument parsing affects multiple language runtimes and tooling (Node.js, PH
In the standard library in Rust before 1.52.0, a double free can occur in the Vec::from_iter function if freeing the ele
In the standard library in Rust before 1.52.0, the Zip implementation can report an incorrect size due to an integer ove
Stored cross-site scripting and open redirect in Warpgate's SSO endpoints (versions prior to 0.25.5) allow an unauthenti
library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginni
Denial of service in the Vector observability pipeline's `logstash` source (versions 0.15.0 through 0.56.x) allows a rem
The Rust Programming Language Standard Library 1.34.x before 1.34.2 contains a stabilized method which, if overridden, c
Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
In the standard library in Rust before 1.52.0, the Zip implementation calls __iterator_get_unchecked() more than once fo
In the standard library in Rust before 1.50.0, read_to_end() does not validate the return value from Read in an unsafe c
Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the `package` configuration
A parser differential in the Rust `zip` crate (zip2) through 9.0.4 lets a crafted archive present different filenames to
Exploit-DB