CVE-2026-31814

HIGH 7.5CVE-2026-31814 · Published 13/03/2026 · updated 17/06/2026

In short

CVE-2026-31814 is a HIGH (CVSS 7.5) vulnerability affecting yamux (protocol).
Chance of exploitation in the next 30 days (EPSS): 0.48%, higher than 41.5% of all vulnerabilities.
Fix: update to 0.13.9 or later.

Package	Affected versions	Patched versions
yamux protocol	`≥ 0.13.0, < 0.13.9`	`0.13.9`

Description

Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. From 0.13.0 to before 0.13.9, a specially crafted WindowUpdate can cause arithmetic overflow in send-window accounting, which triggers a panic in the connection state machine. This is remotely reachable over a normal network connection and does not require authentication. This vulnerability is fixed in 0.13.9.

References

libp2p/rust-yamux security advisory · Exploit

More vulnerabilities in yamux

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free