Py Libp2P
Monthly
Uncontrolled resource consumption in py-libp2p's yamux stream multiplexer allows any remote peer that completes a standard Noise handshake to permanently stall a connection using a single 12-byte frame. Affected versions 0.7.0 and earlier accept an attacker-controlled 32-bit DATA frame length before validating it against the receive window, so a frame claiming a 4 GB body with no body bytes delivered causes the sequential read loop to block indefinitely, freezing every stream on the connection. No patched release exists at time of analysis; a remediation commit is available upstream, and a proof-of-concept demonstrating the stall is documented in the GHSA advisory.
Uncontrolled resource consumption in py-libp2p's yamux stream multiplexer allows any remote peer that completes a standard Noise handshake to permanently stall a connection using a single 12-byte frame. Affected versions 0.7.0 and earlier accept an attacker-controlled 32-bit DATA frame length before validating it against the receive window, so a frame claiming a 4 GB body with no body bytes delivered causes the sequential read loop to block indefinitely, freezing every stream on the connection. No patched release exists at time of analysis; a remediation commit is available upstream, and a proof-of-concept demonstrating the stall is documented in the GHSA advisory.