Is CVE-2026-32314 actively exploited?

No active exploitation of CVE-2026-32314 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-32314 be exploited remotely?

Yes. CVE-2026-32314 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-32314?

CVE-2026-32314 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2026-32314

HIGH

CVE-2026-32314

CWE-248Published: March 16, 2026· Updated: Mar 19, 2026

7.5

CVSS v3.1

EPSS:0.05%probability of exploitation in 30 daysPercentile:15.1th

Official Description

Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. Prior to 0.13.10, the Rust implementation of Yamux can panic when processing a crafted inbound Data frame that sets SYN and uses a body length greater than DEFAULT_CREDIT (e.g. 262145). On the first packet of a new inbound stream, stream state is created and a receiver is queued before oversized-body validation completes. When validation fails, the temporary stream is dropped and cleanup may call remove(...).expect("stream not found"), triggering a panic in the connection state machine. This is remotely reachable over a normal Yamux session and does not require authentication. This vulnerability is fixed in 0.13.10.

NVD Source

Technical Analysis

CVE-2026-32314 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in availability disruption (denial of service), with a CVSS base score of 7.5.