CVE-2026-31814

Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. From 0.13.0 to before 0.13.9, a specially crafted WindowUpdate can cause arithmetic overflow in send-window accounting, which triggers a panic in the connection state machine. This is remotely reachable over a normal network connection and does not require authentication. This vulnerability is fixed in 0.13.9.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/libp2p/rust-yamux/security/advisories/GHSA-4w32-2493-32g7	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:protocol:yamux:*:*:*:*:*:rust:*:*

History

17 Jun 2026, 10:34

Type	Values Removed	Values Added
Summary		(es) Yamux es un multiplexor de flujo sobre conexiones fiables y ordenadas como TCP/IP. Desde 0.13.0 hasta antes de 0.13.9, una WindowUpdate especialmente diseñada puede causar un desbordamiento aritmético en la contabilidad de la ventana de envío, lo que desencadena un pánico en la máquina de estados de la conexión. Esto es alcanzable remotamente a través de una conexión de red normal y no requiere autenticación. Esta vulnerabilidad está corregida en 0.13.9.

19 Mar 2026, 13:51

Type	Values Removed	Values Added
First Time		Protocol Protocol yamux
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5
CPE		cpe:2.3:a:protocol:yamux::::::rust::*
References	~~() https://github.com/libp2p/rust-yamux/security/advisories/GHSA-4w32-2493-32g7 -~~	() https://github.com/libp2p/rust-yamux/security/advisories/GHSA-4w32-2493-32g7 - Exploit, Vendor Advisory

13 Mar 2026, 19:54

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-03-13 19:54

Updated : 2026-06-17 10:34

NVD link : CVE-2026-31814

Mitre link : CVE-2026-31814

CVE.ORG link : CVE-2026-31814

JSON object : View

Products Affected

protocol

yamux

CWE

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2026-31814", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31814", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-03-13T19:37:53.480882Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "libp2p", "product": "rust-yamux", "versions": [{"status": "affected", "version": ">= 0.13.0, < 0.13.9"}]}]}], "published": "2026-03-13T19:54:36.470", "references": [{"url": "https://github.com/libp2p/rust-yamux/security/advisories/GHSA-4w32-2493-32g7", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. From 0.13.0 to before 0.13.9, a specially crafted WindowUpdate can cause arithmetic overflow in send-window accounting, which triggers a panic in the connection state machine. This is remotely reachable over a normal network connection and does not require authentication. This vulnerability is fixed in 0.13.9."}, {"lang": "es", "value": "Yamux es un multiplexor de flujo sobre conexiones fiables y ordenadas como TCP/IP. Desde 0.13.0 hasta antes de 0.13.9, una WindowUpdate especialmente dise\u00f1ada puede causar un desbordamiento aritm\u00e9tico en la contabilidad de la ventana de env\u00edo, lo que desencadena un p\u00e1nico en la m\u00e1quina de estados de la conexi\u00f3n. Esto es alcanzable remotamente a trav\u00e9s de una conexi\u00f3n de red normal y no requiere autenticaci\u00f3n. Esta vulnerabilidad est\u00e1 corregida en 0.13.9."}], "lastModified": "2026-06-17T10:34:30.497", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:protocol:yamux:*:*:*:*:*:rust:*:*", "vulnerable": true, "matchCriteriaId": "86BA699D-3FED-46FB-943E-FCB96C23DDBB", "versionEndExcluding": "0.13.9", "versionStartIncluding": "0.13.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}