Data Frame Length Vulnerability in py-libp2p Python Networking Stack
CVE-2026-73568

7.5HIGH

Key Information:

Vendor

Libp2p

Status
Py-libp2p
Vendor
CVE Published:
13 August 2026

What is CVE-2026-73568?

The py-libp2p implementation of the libp2p networking stack contains a vulnerability in its yamux stream multiplexing system. Specifically, in versions up to 0.7.0, the handle_incoming() method fails to validate a 32-bit DATA frame length against MAX_WINDOW_SIZE or ensure the existence of the stream_id before reading. This oversight allows an attacker, after completing the Noise handshake, to send a 12-byte frame with a maximum length (0xFFFFFFFF) and then withhold the actual data. As a result, the default new_host() configuration enters a blocking state in its sequential read loop, which halts progress on all streams within that connection. Currently, there are no fixes available for this issue.

Affected Version(s)

py-libp2p <= 0.7.0

References

https://github.com/libp2p/py-libp2p/security/advisories/G...
x_refsource_CONFIRM
https://github.com/libp2p/py-libp2p/commit/146ea87d1a20cc...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.