Description

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-02T20:17:37.167Z",
  "pubdate": "2026-09-02T20:17:37.167Z",
  "executiveSummary": "A vulnerability exists in the mux channel management logic where incomplete channel establishment allows a remote peer to trigger a system-wide deadlock.\nThe vulnerability is classified as a Denial-of-Service (DoS) condition caused by improper resource handling during the handshake phase of a connection.\nA malicious peer can exploit this by flooding the incomingRequests queue of a newly registered but not yet established channel.\nThis influx of data causes the connection handling process to deadlock, effectively freezing the mux and rendering the affected connection unresponsive.\nThe impact is a total loss of availability for the specific connection, potentially cascading to other system processes dependent on the mux.\nExploitation requires the attacker to be a connected peer, meaning they have already established a basic link but are in the process of negotiating a new channel.\nThe fix involves the implementation of an atomic established state, ensuring that handlePacket logic drops non-essential packets for unestablished channels to prevent buffer exhaustion and subsequent thread contention.",
  "technicalDetails": "The vulnerability resides within the mux's channel management subsystem, specifically concerning the transition period between channel registration in chanList and the final confirmation of establishment.\nIn the original implementation, once a channel was registered in the chanList, it was exposed to incoming packet processing via handlePacket even before the channel state was fully established or ready for data transmission.\nThe root cause is a synchronization or blocking issue where incomingRequests for an unestablished channel are processed in a way that blocks the primary mux loop or worker threads. Because the channel is registered but not usable, the handling of queued packets triggers a blocking operation that fails to progress due to the incomplete handshake state.\nAn attacker acts by initiating a channel open request and immediately flooding that specific channel with unsolicited packets before the server has sent or received an open confirmation. Since the system treats these packets as pending work within the incomingRequests queue, the accumulation of these packets consumes resources and forces the thread responsible for the mux connection into a wait state.\nThe deadlock occurs because the mux connection becomes stuck trying to process incomingRequests that should have been disregarded until the channel lifecycle was fully realized. By saturating the queue for a state that cannot yet process data, the attacker effectively traps the mux connection process in a blocked state.\nThe fix introduced is the implementation of an atomic established state flag. During the lifecycle of a channel, this flag remains unset until the open confirmation/failure handshake is complete. The handlePacket function has been modified to inspect this atomic flag; if the flag is unset, the handler now drops any packets other than those related to the open confirmation or failure sequences. This prevents the queue from filling with premature packets, avoids blocking the connection loop, and maintains protocol integrity without requiring an immediate tear down of the entire connection."
}