CVE-2026-73568

py-libp2p is the Python implementation of the libp2p networking stack. In 0.7.0 and earlier, the yamux handle_incoming() method in libp2p/stream_muxer/yamux/yamux.py reads an attacker-controlled 32-bit DATA frame length with read_exactly() before validating it against MAX_WINDOW_SIZE or checking whether stream_id exists. A peer that completes the standard Noise handshake can send a 12-byte frame declaring a 0xFFFFFFFF body and then withhold the body, causing the sequential yamux read loop used by the default new_host() configuration to block and preventing every stream on that connection from making progress. No fixed version is available as of this review.

• CWE-400

• https://github.com/libp2p/py-libp2p/commit/146ea87d1a20cc7dacf684ecf7c204543be04b37
• https://github.com/libp2p/py-libp2p/security/advisories/GHSA-hmj8-5xmh-5573
• https://github.com/libp2p/py-libp2p/security/advisories/GHSA-hmj8-5xmh-5573

Published

Aug 13, 2026

Last Modified

Oct 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-73562Mongoose is a MongoDB object modeling tool designed to work …6.5
• CVE-2026-73563Backstage is an open framework for building developer portal…6.1
• CVE-2026-73564frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's…8.7
• CVE-2026-73565@hono/node-server allows running the Hono application on Nod…5.3
• CVE-2026-73566node-tar is a tar archive manipulation library for Node.js. …7.5
• CVE-2026-73567sm-crypto provides JavaScript implementations of the Chinese…9.1
• CVE-2026-73569fast-xml-parser allows users to process XML from JS object w…8.7
• CVE-2026-7357Use after free in GPU in Google Chrome prior to 147.0.7727.1…7.5
• CVE-2026-73570A remote code execution vulnerability exists in Zimbra Colla…8.9
• CVE-2026-73571An authorization bypass vulnerability exists in Zimbra Colla…4.3
• CVE-2026-73572In Zimbra Collaboration (ZCS) before 10.1.17, a stored cross…6.1
• CVE-2026-73573In Zimbra Collaboration (ZCS) before 10.1.17, a path travers…6.5