EUVD-2026-58183
GHSA-hmj8-5xmh-5573
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable with no auth beyond standard handshake (PR:N, AC:L), no confidentiality or integrity impact, availability impact confirmed as High.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
3Blast Radius
ecosystem impact- 6 pypi packages depend on libp2p (6 direct, 0 indirect)
Ecosystem-wide dependent count for version 0.7.0.
DescriptionCVE.org
py-libp2p is the Python implementation of the libp2p networking stack. In 0.7.0 and earlier, the yamux handle_incoming() method in libp2p/stream_muxer/yamux/yamux.py reads an attacker-controlled 32-bit DATA frame length with read_exactly() before validating it against MAX_WINDOW_SIZE or checking whether stream_id exists. A peer that completes the standard Noise handshake can send a 12-byte frame declaring a 0xFFFFFFFF body and then withhold the body, causing the sequential yamux read loop used by the default new_host() configuration to block and preventing every stream on that connection from making progress. No fixed version is available as of this review.
AnalysisAI
Uncontrolled resource consumption in py-libp2p's yamux stream multiplexer allows any remote peer that completes a standard Noise handshake to permanently stall a connection using a single 12-byte frame. Affected versions 0.7.0 and earlier accept an attacker-controlled 32-bit DATA frame length before validating it against the receive window, so a frame claiming a 4 GB body with no body bytes delivered causes the sequential read loop to block indefinitely, freezing every stream on the connection. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The victim must run py-libp2p version 0.7.0 or earlier using the default new_host() yamux configuration - no non-default setup is required on either side. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) accurately represents this vulnerability: the only prerequisite is completing the standard Noise handshake, which is the normal connection setup for any libp2p node, so attack complexity is genuinely low with no authentication barrier. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker operates a libp2p node and initiates a standard connection to the target py-libp2p host, completing the Noise handshake normally - an operation indistinguishable from legitimate peer behavior. The attacker then writes a single 12-byte yamux DATA frame with the length field set to 0xFFFFFFFF (4,294,967,295 bytes) and withholds all body bytes. … |
| Remediation | No officially released patched version of py-libp2p is available at the time of this analysis; the pip package advisory confirms 'fixed in: None.' An upstream remediation commit is available at https://github.com/libp2p/py-libp2p/commit/146ea87d1a20cc7dacf684ecf7c204543be04b37 and should be applied manually or tracked for inclusion in a future tagged release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all systems running py-libp2p 0.7.0 or earlier through dependency scanning and asset inventory, prioritizing production services and documenting which applications depend on this library. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today