crates.io/yamux CVE-2026-32314: high 7.5, EPSS 0.48%

Yamux vulnerable to remote Panic via malformed Data frame with SYN set and len = 262145

Action: Upgrade yamux to 0.13.10 or later.

cargo update -p yamux --precise 0.13.10

Affected

Fixed versions

Sources

• osv: GHSA-vxx9-2994-q338
• nvd: CVE-2026-32314
• https://github.com/libp2p/rust-yamux/security/advisories/GHSA-vxx9-2994-q338
• https://github.com/libp2p/rust-yamux

CVE-2026-32314 · published 2026-03-13T20:04:38Z · modified 2026-03-16T22:16:17.324879Z · JSON