Executive brief
A vulnerability in the py-libp2p networking library allows an attacker to permanently freeze network connections. By sending a specially crafted 12-byte message, a malicious user can cause the system to wait indefinitely for data that will never arrive, effectively cutting off communication for that connection. This impacts the availability of services relying on this library for peer-to-peer networking.
Technical details
The yamux implementation in `libp2p/stream_muxer/yamux/yamux.py` fails to validate the `length` field of incoming DATA and SYN frames against the receive window size. An attacker can send a 12-byte header with a 32-bit length field set to a large value (e.g., 4 GB). The `handle_incoming()` loop then calls `read_exactly()` for the specified length without a timeout, causing the sequential read loop to block indefinitely. This stalls all streams on the affected connection. The vulnerability exists in the default `new_host()` configuration and can be triggered by any peer that completes the initial Noise handshake. As of the advisory, no patched version is specified, but remediation involves enforcing receive window limits on inbound frames.
Affected products
- libp2p py-libp2p <= 0.6.0
Timeline
- 2026-07-23: advisory: GitHub Advisory published