GHSA-vr26-jcq5-fjj8 CVE-2024-45311 RUSTSEC-2024-0373
Denial of service in quinn-proto when using `Endpoint::retry()`
- Severity
- 0.0 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- 0.57%
- Chance of exploitation in the next 30 days. Higher than 47.07% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-670 Always-Incorrect Control Flow Implementation
- Fix
0.11.7- Upgrade quinn-proto to this version or later
Description
Summary
As of quinn-proto 0.11, it is possible for a server to accept(), retry(), refuse(), or ignore() an Incoming connection. However, calling retry() on an unvalidated connection exposes the server to a likely panic in the following situations:
- Calling
refuseorignoreon the resulting validated connection, if a duplicate initial packet is received- This issue can go undetected until a server's
refuse()/ignore()code path is exercised, such as to stop a denial of service attack.
- This issue can go undetected until a server's
- Accepting when the initial packet for the resulting validated connection fails to decrypt or exhausts connection IDs, if a similar initial packet that successfully decrypts and doesn't exhaust connection IDs is received.
- This issue can go undetected if clients are well-behaved.
The former situation was observed in a real application, while the latter is only theoretical.
Details
Location of panic: https://github.com/quinn-rs/quinn/blob/bb02a12a8435a7732a1d762783eeacbb7e50418e/quinn-proto/src/endpoint.rs#L213
Impact
Denial of service for internet-facing server
Affected versions
crates.io
| Package | Vulnerable | Fixed in |
|---|---|---|
| quinn-proto | >= 0.11.0, < 0.11.7 |
0.11.7 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
quinn-proto crates.io → 0.11.7
- cargo
cargo update -p quinn-proto --precise 0.11.7
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- High
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-670: Always-Incorrect Control Flow Implementation
The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| RUSTSEC-2026-0343 Outgoing datagram buffer accounting can panic the sender in quinn-proto | High | Also affects quinn-proto |
| RUSTSEC-2026-0340 Peer minimum ACK delay can panic quinn-proto when ACK_FREQUENCY transmission is enabled | High | Also affects quinn-proto |
| RUSTSEC-2026-0338 Remote peer can panic quinn-proto with zero-length STREAM frames during unordered reads | Not rated yet | Also affects quinn-proto |
| RUSTSEC-2026-0342 Zero-length DATAGRAM frames bypass the receive buffer limit in quinn-proto | Not rated yet | Also affects quinn-proto |
| RUSTSEC-2026-0341 Stream reassembly memory-exhaustion guard in quinn-proto can be bypassed | High | Also affects quinn-proto |
| RUSTSEC-2026-0339 Unbounded growth of pending connection ID retirements in quinn-proto | Not rated yet | Also affects quinn-proto |
| GHSA-4w2j-m93h-cj5j Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly | High | Also affects quinn-proto |
| GHSA-6xvm-j4wr-6v98 Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing | Medium | Also affects quinn-proto |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor