quincy

Post-quantum QUIC-based VPN

View on Cargo

View on Github

Activity

Latest release: 1w ago
Total releases: 84
Cadence: ~9 days
Last 12 months: 28

Reach

Downloads: 61.6k
Stars: 324

Details

License: unknown
First release: Apr 10, 2023

Releases

Version	Released
`3.0.3` patch	Sep 03, 2026
`3.0.2` patch	Aug 07, 2026
`3.0.1` unknown	Jul 28, 2026
`3.0.0` unknown	Jul 24, 2026
`3.0.0-rc.1` unknown	Jul 17, 2026
`2.2.0` unknown	Jun 01, 2026
`2.1.1` unknown	May 14, 2026
`2.1.0` unknown	Apr 27, 2026
`2.0.2` unknown	Apr 21, 2026
`2.0.1` unknown	Apr 08, 2026
`2.0.0` unknown	Mar 24, 2026
`2.0.0-rc.3` unknown	Mar 20, 2026
`2.0.0-rc.2` unknown	Mar 09, 2026
`2.0.0-rc.1` unknown	Mar 09, 2026
`1.3.0` unknown	Feb 06, 2026
`1.2.2` unknown	Jan 06, 2026
`1.2.1` unknown	Dec 25, 2025
`1.2.0` unknown	Dec 24, 2025
`1.1.1` unknown	Dec 13, 2025
`1.1.0` unknown	Dec 12, 2025
`1.0.0` unknown	Dec 12, 2025
`1.0.0-beta.9` unknown	Dec 12, 2025
`1.0.0-beta.8` unknown	Dec 11, 2025
`1.0.0-beta.7` unknown	Dec 11, 2025
`1.0.0-beta.6` unknown	Dec 11, 2025
`1.0.0-beta.5` unknown	Dec 11, 2025
`1.0.0-beta.4` unknown	Dec 11, 2025
`1.0.0-beta.3` unknown yanked	Dec 11, 2025
`0.15.3` unknown	Sep 28, 2025
`1.0.0-beta.2` unknown	Sep 17, 2025
`1.0.0-beta.1` unknown	Sep 13, 2025
`1.0.0-beta.0` unknown	Sep 10, 2025
`0.15.2` unknown	Aug 29, 2025
`0.15.1` unknown	May 10, 2025
`0.15.0` unknown	May 08, 2025
`0.14.1` unknown	Apr 08, 2025
`0.14.0` unknown	Mar 11, 2025
`0.13.0` unknown 1 CVE	Dec 11, 2024
`0.12.3` unknown 1 CVE	Nov 25, 2024
`0.12.2` unknown 1 CVE	Nov 24, 2024
`0.12.1` unknown 1 CVE	Nov 18, 2024
`0.12.0` unknown 1 CVE	Nov 13, 2024
`0.11.2` unknown 1 CVE	Nov 04, 2024
`0.11.1` unknown 1 CVE	Sep 05, 2024
`0.11.0` unknown 1 CVE	Sep 05, 2024
`0.10.4` unknown 1 CVE	Sep 03, 2024
`0.10.3` unknown 1 CVE	Sep 02, 2024
`0.10.2` unknown 1 CVE	Jul 07, 2024
`0.10.1` unknown 1 CVE	Jun 24, 2024
`0.10.0` unknown 1 CVE	Jun 06, 2024

1–50 of 84

Repository

quincy-rs/quincy

Forks: 22
Open issues: 7
Language: Rust

rust
vpn
async
quinn
tokio
quic

Dependencies (28)

Depends on

3.0.3

Used by

Supply-chain exposure

4 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Vulnerable dependencies

2 of 28

rand_core critical 1 CVE
rustls-pemfile 1 CVE

These dependencies are still vulnerable in their latest release. Whether the exact version this package pins is affected isn't checked yet.

Known CVEs (1)

GHSA-hqmp-g7ph-x543 Dec 27, 2024

TunnelVision - decloaking VPNs using DHCP

5.3 / 10
Medium
Adjacent High None None Unchanged High None None

A new decloaking technique for nearly all VPN implementations has been found, which allows attackers to inject entries into the routing tables of unsuspecting victims using DHCP option 121. This allows attackers to redirect traffic, which is supposed to be sent encrypted over the VPN, through the physical interface handling DHCP for the network the victim's computer is connected to, effectively bypassing the VPN connection.

Impact

All users are potentially affected, as this attack vector can be used against any VPN implementation without mitigations in place.

Patches

Currently, there are no existing mitigations employed by Quincy.

Workarounds

Disabling DHCP option 121 in the DHCP client is a potential workaround, as it prevents this kind of attack.

References

https://www.leviathansecurity.com/blog/tunnelvision

References

https://github.com/M0dEx/quincy/security/advisories/GHSA-hqmp-g7ph-x543
https://nvd.nist.gov/vuln/detail/CVE-2024-3661
https://github.com/M0dEx/quincy
https://www.leviathansecurity.com/blog/tunnelvision

Updated May 19, 2025 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

patch 2
unknown 82

84 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More