-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from how yamux handles write timeouts in session management functions. The default configuration (KeepAliveInterval=30s, ConnectionWriteTimeout=10s) creates a window where writes can timeout without closing the session. The send and waitForSendErr functions in session.go are responsible for managing writes to the sendCh channel and error handling. When writes time out, these functions historically did not force a session closure, leaving readers blocked indefinitely. While the advisory was withdrawn (as maintainers argued proper stream closure by applications mitigates the issue), the original analysis shows these functions' behavior under congestion creates the hung Read condition described.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/hashicorp/yamux | go | >= 0.1.0, <= 0.1.2 |
A Semantic Attack on Google Gemini - Read the Latest Research