Yamux is a stream multiplexer used over reliable, ordered connections such as TCP/IP. The Rust implementation before version 0.13.10 contains a flaw that can cause a panic when processing a crafted inbound Data frame that sets the SYN flag and specifies a body length greater than the maximum credit limit (262,145 bytes). This occurs during the creation of a new stream: the stream state is instantiated and a receiver is queued before oversized‑body validation completes. If validation fails, the temporary stream is dropped and cleanup attempts to remove a non‑existent stream, triggering an unrecoverable panic in the connection state machine. The result is a crash of the process that hosts the Yamux connection, leading to a denial‑of‑service condition (CWE‑248). Key detail from vendor advisory: the flaw is due to improper handling of buffer size.

Affected vendor: libp2p:rust‑yamux. All releases prior to 0.13.10 are impacted regardless of configuration. The issue is specific to the Rust implementation; other language bindings are not affected. Key detail from vendor advisory: affected products and versions.

The CVSS score is 8.7 indicating high severity; the EPSS score is below 1%, suggesting current exploitation likelihood is low, and the vulnerability is not listed in the CISA KEV catalog. Attack is remotely reachable over a normal Yamux session and does not require authentication. An adversary can send a malicious Data frame to a running Yamux service, causing a process crash and potential denial of service. Key detail from vendor advisory: exposure is remote, no authentication required.