The vulnerability resides in py-libp2p’s yamux stream multiplexer, where the handle_incoming() routine reads a 32‑bit data frame length before validating that length or ensuring the stream ID is valid. An attacker can craft a noise‑handshake connection and send a 12‑byte frame that claims a 0xFFFFFFFF body followed by no payload. The yamux loop blocks waiting for the non‑existent data, freezing all streams on that connection and effectively denying service to the application using the library.

The affected product is the libp2p Python implementation, first released as py-libp2p. Versions 0.7.0 and earlier are impacted. No vendor has released a patched release as of the last advisory.

With a CVSS score of 7.5 and no EPSS data, the DoS impact is moderate to high. The attack requires remote network access that can complete the Noise handshake, then send the oversized frame. The attack can be carried out by a remote actor with network reachability; the vendor does not list this in CISA KEV. The exploitation path is straightforward and does not require privileged access, suggesting a potentially wide attack surface.