CVE-2024-32984
1 advisory.
crates.io/yamux CVE-2024-32984: high 7.5, EPSS 0.76%
Yamux Memory Exhaustion Vulnerability via Active::pending_frames property
Action: Upgrade yamux to 0.13.2 or later.
cargo update -p yamux --precise 0.13.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.13.0 | 0.13.2 | - |
Fixed versions
| 0.13.2 |
Sources
- osv: GHSA-3999-5ffv-wp2r
- https://github.com/libp2p/rust-yamux/security/advisories/GHSA-3999-5ffv-wp2r
- https://nvd.nist.gov/vuln/detail/CVE-2024-32984
- https://github.com/libp2p/rust-yamux/commit/460baf2ccb7d5982b266cb3cb9c0bdf75b4fb779
- https://github.com/sigp/rust-yamux/commit/6689e227a48258a52347cd1d984adfc94afc6f7a
- https://github.com/libp2p/rust-yamux
- https://github.com/libp2p/rust-yamux/blob/yamux-v0.13.1/yamux/src/connection.rs#L289
CVE-2024-32984 · published · modified · JSON