RUSTSEC-2026-0340 GHSA-3g6h-r5qx-f6hq
Peer minimum ACK delay can panic quinn-proto when ACK_FREQUENCY transmission is enabled
- Severity
- 7.5 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
0.11.18- Upgrade quinn-proto to this version or later
Description
When sending ACK_FREQUENCY frames is enabled through
TransportConfig::ack_frequency_config(Some(..)), the peer's transport parameters could cause
AckFrequencyState::candidate_max_ack_delay to call Duration::clamp with a minimum greater
than its maximum, which panics.
For example, a peer advertising a min_ack_delay of 100,000 microseconds and a max_ack_delay
of 100 milliseconds passes transport parameter validation. At a 5 ms RTT, the lower bound of the
clamp becomes 100 ms while the upper bound is 25 ms, violating the precondition of clamp and
panicking while driving the connection. Both automatically derived and explicitly configured
maximum ACK delays use this calculation.
Sending ACK_FREQUENCY frames is disabled by default, so only endpoints that opt in are affected.
The flaw was corrected in 0.11.18 by computing the delay with explicit minimum and maximum bounds
instead of clamp.
Thanks to @zerox80 for reporting this issue.
Affected versions
crates.io
| Package | Vulnerable | Fixed in |
|---|---|---|
| quinn-proto | >= 0.11.0, < 0.11.18 |
0.11.18 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
quinn-proto crates.io → 0.11.18
- cargo
cargo update -p quinn-proto --precise 0.11.18
Severity breakdown
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| RUSTSEC-2026-0343 Outgoing datagram buffer accounting can panic the sender in quinn-proto | High | Also affects quinn-proto |
| RUSTSEC-2026-0338 Remote peer can panic quinn-proto with zero-length STREAM frames during unordered reads | Not rated yet | Also affects quinn-proto |
| RUSTSEC-2026-0342 Zero-length DATAGRAM frames bypass the receive buffer limit in quinn-proto | Not rated yet | Also affects quinn-proto |
| RUSTSEC-2026-0341 Stream reassembly memory-exhaustion guard in quinn-proto can be bypassed | High | Also affects quinn-proto |
| RUSTSEC-2026-0339 Unbounded growth of pending connection ID retirements in quinn-proto | Not rated yet | Also affects quinn-proto |
| GHSA-4w2j-m93h-cj5j Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly | High | Also affects quinn-proto |
| GHSA-6xvm-j4wr-6v98 Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing | Medium | Also affects quinn-proto |
| GHSA-vr26-jcq5-fjj8 Denial of service in quinn-proto when using `Endpoint::retry()` | High | Also affects quinn-proto |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor