8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-31814

CVE-2026-31814: Yamux remote Panic via malformed WindowUpdate credit

Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. From 0.13.0 to before 0.13.9, a specially crafted WindowUpdate can cause arithmetic overflow in send-window accounting, which triggers a panic in the connection state machine. This is remotely reachable over a normal network connection and does not require authentication. This vulnerability is fixed in 0.13.9.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-31814

CVE-2026-31814:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
yamux	rust	>= 0.13.0, < 0.13.9	0.13.9

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an integer overflow in the rust-yamux library, which can be triggered by a remote, unauthenticated attacker to cause a denial of service. The root cause lies in the FlowController.increase_send_window_by function, located in yamux/src/connection/stream/flow_control.rs. In the vulnerable versions, this function used checked_add with .expect(), which would cause a panic if the addition of credit to the stream's send window resulted in an overflow.

The attack is initiated when a malicious WindowUpdate frame is sent by a peer. This frame is processed by the Active.process_frame function in yamux/src/connection.rs. This function extracts the credit value and, through a call to Shared.increase_send_window_by, triggers the vulnerable logic in FlowController.increase_send_window_by. The resulting unhandled panic crashes the connection's state machine.

The patch addresses this by changing the function signatures to return a Result<(), ConnectionError> instead of panicking. The checked_add is replaced with .ok_or(ConnectionError::InvalidWindowUpdate), and the calling function Active.process_frame is updated to handle this error gracefully by terminating the connection with a protocol error instead of crashing.

Vulnerable functions

FlowController.increase_send_window_by

yamux/src/connection/stream/flow_control.rs

This function is the root cause of the vulnerability. In the vulnerable version, it uses `checked_add` followed by `.expect()`. When a malicious `WindowUpdate` frame with a large credit value is received, the addition overflows, triggering a panic that crashes the connection.

Shared.increase_send_window_by

yamux/src/connection/stream.rs

This function acts as a wrapper and directly calls the vulnerable `FlowController.increase_send_window_by`. It is part of the call stack that leads to the panic. The patch modifies its signature to propagate the error instead of panicking.

Active.process_frame

yamux/src/connection.rs

This function is responsible for processing incoming Yamux frames. When it receives a `WindowUpdate` frame, it calls `Shared.increase_send_window_by` with the credit value from the remote peer. In the vulnerable version, it does not handle the potential panic from the callee, allowing the arithmetic overflow to crash the entire connection state machine.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.