CVE-2026-31814: Protocol Yamux DOS Vulnerability

CVE-2026-31814 Overview

CVE-2026-31814 is a high-severity integer overflow vulnerability in Yamux, a stream multiplexer over reliable, ordered connections such as TCP/IP. The vulnerability affects versions 0.13.0 through 0.13.8 and allows remote attackers to trigger an arithmetic overflow in send-window accounting through a specially crafted WindowUpdate message. This overflow causes a panic in the connection state machine, resulting in a denial of service condition. The vulnerability is particularly concerning because it is remotely reachable over a normal network connection and does not require authentication.

Critical Impact
Unauthenticated remote attackers can crash Yamux connections by sending malicious WindowUpdate frames, causing denial of service in applications using the rust-yamux library for peer-to-peer communications.

Affected Products

Protocol Yamux versions 0.13.0 to 0.13.8 (Rust crate)
Applications using rust-yamux for libp2p networking
Peer-to-peer systems relying on Yamux stream multiplexing

Discovery Timeline

2026-03-13 - CVE-2026-31814 published to NVD
2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-31814

Vulnerability Analysis

This vulnerability stems from an integer overflow weakness (CWE-190) in the Yamux protocol implementation for Rust. Yamux uses a windowed flow control mechanism similar to TCP, where WindowUpdate frames are exchanged to manage the send window size for each stream. The vulnerability exists in how the library processes incoming WindowUpdate messages and updates its internal send-window accounting.

When a malicious peer sends a specially crafted WindowUpdate frame with carefully chosen values, the arithmetic operation used to update the send window can overflow. In Rust, integer overflow behavior depends on the build configuration—in debug builds, overflows trigger a panic, while in release builds with default settings, the value wraps around. Either scenario can corrupt the connection state machine, leading to unexpected behavior or crashes.

The attack does not require any authentication, making it accessible to any network peer that can establish a Yamux connection. This is particularly impactful in peer-to-peer networking scenarios where connections may be established with untrusted parties.

Root Cause

The root cause is insufficient bounds checking when processing WindowUpdate frames in the send-window accounting logic. The implementation fails to validate that the window increment value, when added to the current send window, does not exceed the maximum representable value for the integer type used. This allows an attacker to craft WindowUpdate messages that cause arithmetic overflow when processed.

Attack Vector

The attack can be executed remotely over any network connection using the Yamux protocol. An attacker establishes a Yamux connection with the target application, then sends a malicious WindowUpdate frame containing values designed to trigger the arithmetic overflow. The attack requires no authentication or special privileges, making it accessible to any peer that can initiate or accept Yamux connections.

The vulnerability is exploitable by sending a WindowUpdate frame with a window increment value that, when added to the current send window balance, causes an integer overflow. The malicious frame must be constructed to target the specific arithmetic operation in the send-window accounting code.

Detection Methods for CVE-2026-31814

Indicators of Compromise

Unexpected Yamux connection terminations or panics in application logs
Rust panic messages referencing arithmetic overflow in yamux crate code
Unusual patterns of WindowUpdate frames with large increment values
Elevated rate of connection resets from specific peers

Detection Strategies

Monitor application logs for panic messages originating from the yamux library
Implement network traffic analysis to identify anomalous WindowUpdate frame sizes
Deploy intrusion detection rules to flag WindowUpdate frames with suspiciously large window increment values
Track connection stability metrics to identify potential exploitation attempts

Monitoring Recommendations

Enable detailed logging for Yamux connection state changes and errors
Configure alerting on application crashes or panics related to stream multiplexing
Monitor peer behavior for patterns consistent with denial of service attempts
Implement connection rate limiting to reduce the impact of repeated exploitation attempts

How to Mitigate CVE-2026-31814

Immediate Actions Required

Upgrade rust-yamux to version 0.13.9 or later immediately
Review applications using libp2p or rust-yamux for affected versions
Audit Cargo.lock files to identify direct and transitive dependencies on vulnerable yamux versions
Consider temporarily restricting connections from untrusted peers until patching is complete

Patch Information

The vulnerability is fixed in rust-yamux version 0.13.9. The fix implements proper bounds checking on WindowUpdate processing to prevent arithmetic overflow in send-window accounting. Update your Cargo.toml to require the patched version:

toml

[dependencies]
yamux = ">=0.13.9"

For detailed information about the vulnerability and patch, see the GitHub Security Advisory.

Workarounds

If immediate patching is not possible, implement connection filtering to limit exposure to untrusted peers
Deploy network-level rate limiting on Yamux connections to reduce exploitation impact
Consider wrapping Yamux connections with additional monitoring to detect and terminate suspicious sessions
Run applications with panic abort handlers to ensure clean shutdown on exploitation attempts

bash

# Update rust-yamux dependency to patched version
cargo update -p yamux
# Verify the updated version
cargo tree -i yamux