CVE-2026-31814
High · 7.5CVSS
7.5
EPSS
0.6%
Published
Mar 13, 2026
CISA due date
—
The record
Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. From 0.13.0 to before 0.13.9, a specially crafted WindowUpdate can cause arithmetic overflow in send-window accounting, which triggers a panic in the connection state machine. This is remotely reachable over a normal network connection and does not require authentication. This vulnerability is fixed in 0.13.9.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | yamux | 0.13.0 | 0.13.9 |
Related vulnerabilities
- GHSA-4w32-2493-32g7 Yamux vulnerable to remote Panic via malformed WindowUpdate credit Same vulnerability
- CVE-2026-32314 Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. Also affects yamux
- GHSA-vxx9-2994-q338 Yamux vulnerable to remote Panic via malformed Data frame with SYN set and len = 262145 Also affects yamux
- CVE-2026-110264 An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before… CWE-190
- CVE-2026-53615 util-linux is a random collection of Linux utilities. CWE-190
- CVE-2026-106574 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-190
- CVE-2026-106571 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-190
- CVE-2026-75820 GNU Aspell contains an integer truncation vulnerability in the WritableDict::add()… CWE-190