CVE-2026-32314

High

Description

Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. Prior to 0.13.10, the Rust implementation of Yamux can panic when processing a crafted inbound Data frame that sets SYN and uses a body length greater than DEFAULT_CREDIT (e.g. 262145). On the first packet of a new inbound stream, stream state is created and a receiver is queued before oversized-body validation completes. When validation fails, the temporary stream is dropped and cleanup may call remove(...).expect("stream not found"), triggering a panic in the connection state machine. This is remotely reachable over a normal Yamux session and does not require authentication. This vulnerability is fixed in 0.13.10.

SeverityHigh

CVSS7.5

Exploit probability—

ProductProtocol Yamux

PublishedMar 16, 2026

First seenMar 16, 2026

Weakness typeCWE-248CWE-248

How to fix

Update

protocol yamux0.13.10 or later

Affected products

Product	Affected versions	Fixed in
protocol yamux	v < 0.13.10	0.13.10

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.