Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
hashicorp/yamux
master @ 90aa224
3
Fixes
2
CVEs
HIGH
Peak severity
33.3%
Coverage
Highlights
Data Race: 2 prior fixes. Scrutinize any change in this area.
session.go: most-fixed (2 issues). Treat as high-risk during review.
0 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Data Race: Concurrent access to stream body buffers and connection writes during shutdown or write timeouts can lead to memory corruption or crashes. Safe synchronization using local buffers and mutexes is required to isolate state.
Race Condition: Sharing unprotected stream-level headers during backlog overflows leads to concurrent write data races. Safe local allocation of frame headers must be enforced rather than sharing instance-level structures.
Denial of Service: Arithmetic overflow in send-window accounting via crafted WindowUpdate frames and panics caused by crafted inbound Data frames with SYN flags allow unauthenticated remote attackers to crash the Yamux session.