Yamux remote Panic via malformed Data frame with SYN set and len = 262145

Vulnerability

Overview

The Rust implementation of the Yamux stream multiplexer, used in protocols like libp2p, contains a logic flaw in its stream state management [1][2]. When an inbound Data frame with the SYN flag set SYN flag and a body length greater than DEFAULT_CREDIT (e.g., 262145 bytes) is processed, the code creates a new stream state and queues a receiver before validating the oversized body. If validation then fails, the temporary stream is dropped, and cleanup triggers a call to remove(...).expect("stream not found"), resulting in a panic in the connection state machine [3].

Attack

Vector and Prerequisites

An attacker who can establish a Yamux session with a target node—over a reliable, ordered transport such as TCP/IP—can crash the target by sending a single crafted frame [3]. The attack requires no authentication; it only needs a standard Yamux session to be negotiated. The malicious frame is a validly encoded Data|SYN frame with a body length equal to DEFAULT_CREDIT + 1 (e.g., 262145), sent on a new inbound stream ID [3.

Impact

Successful exploitation terminates the process on the vulnerable system, depending on the host application's panic policy. This constitutes a remote denial-of-service (DoS) vulnerability that can disrupt services relying on the affected Yamux implementation [1].

Mitigation

The vulnerability is fixed in version 0.13.10 of the Rust Yamux library [1][3]. Users are advised to upgrade immediately. No workarounds are documented; the fix ensures stream cleanup does not panic on validation failure [3].