How severe is CVE-2026-31814?

CVE-2026-31814 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2026-31814 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (37th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-31814?

CVE-2026-31814 affects Protocol Yamux. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-31814?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2026-31814 have an EU (EUVD) identifier?

Yes. CVE-2026-31814 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-12083.

When was CVE-2026-31814 published?

CVE-2026-31814 was published on 2026-03-13 and last updated on 2026-06-17.

CVE-2026-31814

CVE-2026-31814 is a high-severity vulnerability in Protocol Yamux with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-190.

Key facts

Severity: High (CVSS 3.x base score 7.5)
CVSS v4: 8.7
EPSS exploit prediction: 0% (37th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-12083
Weakness: CWE-190
Affected product: Protocol Yamux
Published: 2026-03-13
Last modified: 2026-06-17

Description

Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. From 0.13.0 to before 0.13.9, a specially crafted WindowUpdate can cause arithmetic overflow in send-window accounting, which triggers a panic in the connection state machine. This is remotely reachable over a normal network connection and does not require authentication. This vulnerability is fixed in 0.13.9.

Frequently asked questions

What is CVE-2026-31814?: Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. From 0.13.0 to before 0.13.9, a specially crafted WindowUpdate can cause arithmetic overflow in send-window accounting, which triggers a panic in the connection state machine. This is remotely reachable over a normal network connection and does not require authentication. This vulnerability is fixed in 0.13.9.
How severe is CVE-2026-31814?: CVE-2026-31814 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2026-31814 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (37th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-31814?: CVE-2026-31814 affects Protocol Yamux. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-31814?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2026-31814 have an EU (EUVD) identifier?: Yes. CVE-2026-31814 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-12083.
When was CVE-2026-31814 published?: CVE-2026-31814 was published on 2026-03-13 and last updated on 2026-06-17.

References

https://github.com/libp2p/rust-yamux/security/advisories/GHSA-4w32-2493-32g7

Affected products (1)

cpe:2.3:a:protocol:yamux:*:*:*:*:*:rust:*:*

More vulnerabilities in Protocol Yamux

CVE-2026-32314 — High (CVSS 7.5): Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. Prior to 0.13.10, the Rust…

All CVEs affecting Protocol Yamux →

Other CWE-190 (Integer Overflow or Wraparound) vulnerabilities

CVE-2026-4689 — Critical (CVSS 10.0): Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability was…
CVE-2026-24814 — Critical (CVSS 10.0): Integer Overflow or Wraparound vulnerability in swoole swoole-src (thirdparty/hiredis modules). This vulnerability is…
CVE-2025-64721 — Critical (CVSS 10.0): Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. In versions…
CVE-2015-5108 — Critical (CVSS 10.0): Integer overflow in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC…
CVE-2015-5097 — Critical (CVSS 10.0): Integer overflow in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC…
CVE-2013-2555 — Critical (CVSS 10.0): Integer overflow in Adobe Flash Player before 10.3.183.75 and 11.x before 11.7.700.169 on Windows and Mac OS X, before…

Browse all CWE-190 (Integer Overflow or Wraparound) vulnerabilities →