CVE-2026-32314: 
Rust vulnerability analysis and mitigation

CVE-2026-32314 is a remote Denial of Service vulnerability in the Rust implementation of Yamux (rust-yamux), a stream multiplexer used in libp2p-based applications. The flaw allows an unauthenticated remote attacker to crash the target process by sending a single crafted Yamux Data frame with the SYN flag set and a body length exceeding DEFAULT_CREDIT (e.g., 262,145 bytes). All versions of the yamux Rust crate prior to 0.13.10 are affected. The vulnerability was published on March 13, 2026, and was originally reported by @revofusion to the Ethereum Foundation bug bounty program. It carries a CVSS v4 base score of 8.7 (High) and a CVSS v3.1 base score of 7.5 (High) (Github Advisory, libp2p Advisory).

The root cause is an uncaught exception / reachable assertion (CWE-248, CWE-617) in the Yamux connection state machine. When the first packet of a new inbound stream arrives with the Data+SYN flags set, the implementation creates stream state and queues a receiver before completing validation of the frame body length against DEFAULT_CREDIT (256 KiB). When validation subsequently fails, the temporary stream is dropped and cleanup code calls remove(...).expect("stream not found") — but because the stream was never fully registered, the expect call panics, terminating the process. The attack requires only the ability to establish a standard Yamux session (no special privileges or authentication beyond session negotiation) and is triggered by a single validly encoded frame (libp2p Advisory, Github Advisory).

Successful exploitation causes an immediate process crash (panic) in any application using the vulnerable yamux Rust crate, resulting in a complete loss of availability for the affected service. There is no confidentiality or integrity impact — the vulnerability is purely a Denial of Service. Because Yamux is widely used in libp2p-based peer-to-peer infrastructure (including Ethereum and IPFS ecosystem nodes), a single malicious peer can repeatedly crash target nodes, potentially disrupting network participation or consensus operations (libp2p Advisory, Github Advisory).

The advisory includes concrete, step-by-step proof-of-concept exploit instructions describing the exact frame parameters needed to trigger the panic, and Feedly classifies this as a real exploit with high confidence (libp2p Advisory). No evidence of in-the-wild exploitation has been reported as of the time of publication. The vulnerability requires no authentication and no user interaction, making it trivially automatable against any exposed Yamux endpoint. The EPSS score is approximately 0.05–0.11% (29th percentile), indicating low but non-negligible exploitation probability in the near term. The vulnerability is not currently listed in the CISA KEV catalog.

1. Reconnaissance: Identify target nodes running libp2p-based applications (e.g., Ethereum clients, IPFS nodes) that use the vulnerable yamux Rust crate (versions < 0.13.10). Scan for exposed peer-to-peer ports or use peer discovery mechanisms native to the target network.
2. Establish a Yamux session: Connect to the target using a standard transport (e.g., TCP with noise or TLS) and complete the handshake to negotiate a Yamux multiplexed session. No special credentials are required beyond what the transport layer demands.
3. Craft the malicious frame: Construct a single Yamux frame with the following parameters:
   • Tag = Data
   • Flags = SYN
   • StreamId = 1 (or any valid new inbound stream ID)
   • Length = DEFAULT_CREDIT + 1 = 262145
   • Body = 262145 bytes of arbitrary data
4. Send the frame: Transmit the crafted frame over the established Yamux session to the target.
5. Trigger the panic: The target's Yamux state machine creates stream state and queues a receiver, then fails body-length validation, attempts to remove the unregistered stream, and calls remove(...).expect("stream not found"), causing a panic that terminates the process (libp2p Advisory).

• Network: Inbound Yamux Data+SYN frames with a declared body length of 262145 bytes or greater on peer-to-peer ports; unexpected connection attempts from unknown peers followed immediately by process termination.
• Logs: Rust panic messages containing "stream not found" or called \Option::unwrap()` on a `None` value` in application logs; abrupt process exit with a non-zero exit code immediately after a new peer connection.
• Process: Sudden crash/restart of libp2p-based services (e.g., Ethereum node, IPFS daemon) without prior resource exhaustion or OS-level signals; repeated process restarts correlated with inbound peer connections (libp2p Advisory).

Users should upgrade the yamux Rust crate to version 0.13.10 or later, which fixes the validation ordering issue so that oversized-body checks occur before stream state is created (libp2p Advisory, Github Advisory). As a temporary workaround where upgrading is not immediately possible, implement network-level access controls (firewall rules, allowlists) to restrict which peers can establish Yamux sessions with critical infrastructure nodes. There is no known configuration-only mitigation within the library itself.

The vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program, highlighting its relevance to blockchain infrastructure (libp2p Advisory). Tenable added detection support via Nessus plugin 302263 shortly after disclosure. No significant broader media coverage or notable public researcher commentary beyond the advisory itself has been identified.