CVE-2026-73568

Name of the Vulnerable Software and Affected Versions py-libp2p versions 0.7.0 and earlier

Description The handle incoming() function in the yamux module reads a 32-bit DATA frame length using read exactly() before validating it against MAX WINDOW SIZE or verifying the existence of the stream id. A peer that has completed the Noise handshake can send a 12-byte frame specifying a body length of 0xFFFFFFFF and then withhold the actual body. This action causes the sequential yamux read loop used by the default new host() configuration to block, which prevents all streams on that connection from progressing.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.