x/vulndb: potential Go vuln in github.com/hashicorp/yamux: GHSA-29qp-crvh-w22m

[GoVulnBot]

Advisory GHSA-29qp-crvh-w22m references a vulnerability in the following Go modules:

Module
github.com/hashicorp/yamux

Description:
The default values for Session.config.KeepAliveInterval and Session.config.ConnectionWriteTimeout of 30s and 10s create the possibility for timed out writes that most aren't handling in their readers.

Calls to Stream.Read on one side of a connection will hang until the underlying Session is closed if the corresponding Stream.Write call on the other side it's waiting for returns with ErrConnectionWriteTimeout. This happens in the case of network congestion between the two sides.

If you keep Session.sendCh full (fixed capacity of 64) for ConnectionWriteTimeout, but for less than the KeepAliveI...

References:

• ADVISORY: GHSA-29qp-crvh-w22m
• FIX: Close Session when there's failures to write to a Stream hashicorp/yamux#143
• REPORT: x/vulndb: potential Go vuln in github.com/hashicorp/yamux #3408
• REPORT: DefaultConfig has dangerous defaults causing hung Reads hashicorp/yamux#142

Cross references:

• github.com/hashicorp/yamux appears in 1 other report(s):
  • data/reports/GO-2025-3408.yaml (x/vulndb: potential Go vuln in github.com/hashicorp/yamux #3408)

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/hashicorp/yamux
      non_go_versions:
        - introduced: TODO (earliest fixed "", vuln range ">= 0.1.0, <= 0.1.2")
      vulnerable_at: 0.1.2
summary: |-
    github.com/hashicorp/yamux's DefaultConfig has dangerous defaults causing hung
    Read in github.com/hashicorp/yamux
ghsas:
    - GHSA-29qp-crvh-w22m
references:
    - advisory: https://github.com/advisories/GHSA-29qp-crvh-w22m
    - fix: https://github.com/hashicorp/yamux/pull/143
    - report: https://github.com/golang/vulndb/issues/3408
    - report: https://github.com/hashicorp/yamux/issues/142
source:
    id: GHSA-29qp-crvh-w22m
    created: 2025-01-29T20:01:27.54291827Z
review_status: UNREVIEWED

[tatianab]

Withdrawn report.