RUSTSEC-2026-0338 GHSA-465w-v9q3-7j98
Remote peer can panic quinn-proto with zero-length STREAM frames during unordered reads
- Severity
- Not rated yet
- No source has published a CVSS score yet
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
0.11.18- Upgrade quinn-proto to this version or later
Description
When a stream is read in unordered mode (for example through RecvStream::read(false) in
quinn-proto or read_unordered in quinn), quinn-proto proactively deduplicates received data
by recording received ranges in a RangeSet through its replace method. When an incoming
STREAM frame carried an empty payload, the Drop implementation of the iterator returned by
replace inserted an empty range into the set, violating the invariant that stored ranges are
non-empty. Subsequent frames overlapping that region then caused a panic while processing the
stream.
A remote peer can trigger this with five small STREAM frames (two of them zero-length) once the application has put the stream in unordered-read mode. The default ordered read path is not affected.
The flaw was corrected in 0.11.18 by ignoring empty ranges in RangeSet::replace.
Thanks to Otto Hermann (@ojhermann) for reporting this issue.
Affected versions
crates.io
| Package | Vulnerable | Fixed in |
|---|---|---|
| quinn-proto | >= 0.7.0, < 0.11.18 |
0.11.18 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
quinn-proto crates.io → 0.11.18
- cargo
cargo update -p quinn-proto --precise 0.11.18
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| RUSTSEC-2026-0343 Outgoing datagram buffer accounting can panic the sender in quinn-proto | High | Also affects quinn-proto |
| RUSTSEC-2026-0340 Peer minimum ACK delay can panic quinn-proto when ACK_FREQUENCY transmission is enabled | High | Also affects quinn-proto |
| RUSTSEC-2026-0342 Zero-length DATAGRAM frames bypass the receive buffer limit in quinn-proto | Not rated yet | Also affects quinn-proto |
| RUSTSEC-2026-0341 Stream reassembly memory-exhaustion guard in quinn-proto can be bypassed | High | Also affects quinn-proto |
| RUSTSEC-2026-0339 Unbounded growth of pending connection ID retirements in quinn-proto | Not rated yet | Also affects quinn-proto |
| GHSA-4w2j-m93h-cj5j Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly | High | Also affects quinn-proto |
| GHSA-6xvm-j4wr-6v98 Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing | Medium | Also affects quinn-proto |
| GHSA-vr26-jcq5-fjj8 Denial of service in quinn-proto when using `Endpoint::retry()` | High | Also affects quinn-proto |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor