8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32314

CVE-2026-32314: Yamux remote Panic via malformed Data frame with SYN set and len = 262145

Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. Prior to 0.13.10, the Rust implementation of Yamux can panic when processing a crafted inbound Data frame that sets SYN and uses a body length greater than DEFAULT_CREDIT (e.g. 262145). On the first packet of a new inbound stream, stream state is created and a receiver is queued before oversized-body validation completes. When validation fails, the temporary stream is dropped and cleanup may call remove(...).expect("stream not found"), triggering a panic in the connection state machine. This is remotely reachable over a normal Yamux session and does not require authentication. This vulnerability is fixed in 0.13.10.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32314

CVE-2026-32314:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
yamux	rust	< 0.13.10	0.13.10

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, as described, is a remote panic in rust-yamux caused by a malformed Data frame with the SYN flag and an oversized body. The analysis started by identifying the patched version, 0.13.10, and the last vulnerable version, 0.13.9. By comparing the git tags for these versions, the commit ac71745226b99191249bbbb0420aceba052c150c was identified as the security patch. The patch is in the file yamux/src/connection.rs and adds a length check for the body of an incoming frame before a new stream is created. This change is located within the on_frame function of the Active struct implementation. Therefore, yamux::connection::Active::on_frame is the function that processes the malicious input and contains the vulnerability. The exploit triggers a panic within this function's logic when handling a new stream request.

Vulnerable functions

yamux::connection::Active::on_frame

yamux/src/connection.rs

The vulnerability lies in the `on_frame` function within the `Active` implementation in `yamux/src/connection.rs`. When a new stream is initiated with a `SYN` flag, the original code proceeded to create a new inbound stream (`make_new_inbound_stream`) before validating the length of the frame's body. An attacker could send a frame with a body length exceeding `DEFAULT_CREDIT`. This would lead to the creation of a stream, followed by a validation failure, which would then trigger a panic when trying to clean up the non-existent stream. The patch mitigates this by adding a check for the frame's body length before the stream is created, thus preventing the panic.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.