GHSA-hmj8-5xmh-5573: libp2p: yamux connection DoS via oversized data frame

July 24, 2026 (updated August 13, 2026)

The yamux stream multiplexer in py-libp2p does not validate incoming DATA frame lengths against the receive window before reading the frame body. Any peer that completes a standard libp2p handshake can send a single 12-byte frame claiming a 4 GB body, causing the victim’s yamux read loop to block indefinitely. This affects the default new_host() configuration and requires no special setup on either side.

References

github.com/advisories/GHSA-hmj8-5xmh-5573
github.com/libp2p/py-libp2p/commit/146ea87d1a20cc7dacf684ecf7c204543be04b37
github.com/libp2p/py-libp2p/security/advisories/GHSA-hmj8-5xmh-5573
nvd.nist.gov/vuln/detail/CVE-2026-73568

Code Behaviors & Features

Detect and mitigate GHSA-hmj8-5xmh-5573 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →