Answer in brief
CVE-2026-73568 records a High severity (CVSS 7.5) vulnerability in py-libp2p: yamux connection DoS via oversized data frame. The current sources do not mark it as known exploited. The current feed maps libp2p/py-libp2p (generic), libp2p (pip), libp2p (pypi). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps libp2p/py-libp2p (generic), libp2p (pip), libp2p (pypi). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| libp2p/py-libp2pgeneric | <= 0.7.0 | Not reported |
| libp2ppip | <=0.7.0 | Not reported |
| libp2ppypi | >=0 | Not reported |
Published upstream
Aug 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 8, 2026
py-libp2p is the Python implementation of the libp2p networking stack. In 0.7.0 and earlier, the yamux handle_incoming() method in libp2p/stream_muxer/yamux/yamux.py reads an attacker-controlled 32-bit DATA frame length with read_exactly() before validating it against MAX_WINDOW_SIZE or checking whether stream_id exists. A peer that completes the standard Noise handshake can send a 12-byte frame declaring a 0xFFFFFFFF body and then withhold the body, causing the sequential yamux read loop used by the default new_host() configuration to block and preventing every stream on that connection from making progress. No fixed version is available as of this review.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-73568 records a High severity (CVSS 7.5) vulnerability in py-libp2p: yamux connection DoS via oversized data frame. The current sources do not mark it as known exploited. The current feed maps libp2p/py-libp2p (generic), libp2p (pip), libp2p (pypi). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps libp2p/py-libp2p (generic), libp2p (pip), libp2p (pypi). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| libp2p/py-libp2pgeneric | <= 0.7.0 | Not reported |
| libp2ppip | <=0.7.0 | Not reported |
| libp2ppypi | >=0 | Not reported |
Published upstream
Aug 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 8, 2026
py-libp2p is the Python implementation of the libp2p networking stack. In 0.7.0 and earlier, the yamux handle_incoming() method in libp2p/stream_muxer/yamux/yamux.py reads an attacker-controlled 32-bit DATA frame length with read_exactly() before validating it against MAX_WINDOW_SIZE or checking whether stream_id exists. A peer that completes the standard Noise handshake can send a 12-byte frame declaring a 0xFFFFFFFF body and then withhold the body, causing the sequential yamux read loop used by the default new_host() configuration to block and preventing every stream on that connection from making progress. No fixed version is available as of this review.
Quoted source text, attributed separately from HOL analysis.