quinn-proto

Version	Released
`0.11.18` patch	Sep 14, 2026
`0.11.17` patch	Aug 17, 2026
`0.11.16` unknown	Jul 04, 2026
`0.11.15` unknown	Jun 22, 2026
`0.11.14` unknown 1 CVE	Mar 09, 2026
`0.11.13` unknown 2 CVEs	Aug 27, 2025
`0.11.12` unknown 2 CVEs	May 09, 2025
`0.11.11` unknown 2 CVEs	Apr 22, 2025
`0.11.10` unknown 2 CVEs	Mar 18, 2025
`0.11.9` unknown 2 CVEs	Nov 13, 2024
`0.11.8` unknown 2 CVEs	Sep 03, 2024
`0.11.7` unknown 2 CVEs	Sep 02, 2024
`0.11.6` unknown 3 CVEs	Aug 04, 2024
`0.11.5` unknown yanked 3 CVEs	Aug 04, 2024
`0.11.4` unknown yanked 3 CVEs	Aug 03, 2024
`0.11.3` unknown 3 CVEs	Jun 07, 2024
`0.11.2` unknown 3 CVEs	May 24, 2024
`0.11.1` unknown 3 CVEs	May 08, 2024
`0.11.0` unknown 3 CVEs	May 06, 2024
`0.10.6` unknown 2 CVEs	Nov 07, 2023
`0.9.6` unknown 2 CVEs	Oct 09, 2023
`0.10.5` unknown 2 CVEs	Sep 20, 2023
`0.9.5` unknown 2 CVEs	Sep 20, 2023
`0.10.4` unknown 2 CVEs	Aug 24, 2023
`0.10.3` unknown 2 CVEs	Aug 20, 2023
`0.10.2` unknown 2 CVEs	Aug 02, 2023
`0.9.4` unknown 3 CVEs	Jul 21, 2023
`0.10.1` unknown 2 CVEs	May 11, 2023
`0.10.0` unknown 2 CVEs	May 11, 2023
`0.9.3` unknown 3 CVEs	Mar 28, 2023
`0.9.2` unknown 3 CVEs	Dec 05, 2022
`0.9.1` unknown 3 CVEs	Nov 16, 2022
`0.9.0` unknown 3 CVEs	Oct 26, 2022
`0.8.4` unknown 3 CVEs	Aug 12, 2022
`0.8.3` unknown 3 CVEs	May 25, 2022
`0.8.2` unknown 3 CVEs	Mar 28, 2022
`0.8.1` unknown 3 CVEs	Feb 19, 2022
`0.8.0` unknown 3 CVEs	Nov 14, 2021
`0.7.3` unknown 3 CVEs	May 03, 2021
`0.7.2` unknown 3 CVEs	Apr 04, 2021
`0.7.1` unknown 3 CVEs	Mar 20, 2021
`0.7.0` unknown 3 CVEs	Mar 02, 2021
`0.6.1` unknown 3 CVEs	Apr 04, 2020
`0.6.0` unknown 3 CVEs	Mar 12, 2020
`0.5.2` unknown 3 CVEs	Dec 15, 2019
`0.5.0` unknown 3 CVEs	Dec 03, 2019
`0.4.0` unknown 3 CVEs	Sep 09, 2019
`0.3.0` unknown 3 CVEs	Apr 18, 2019
`0.2.0` unknown 3 CVEs	Jan 21, 2019
`0.1.0` unknown 3 CVEs	Oct 02, 2018

0.11.18 patch

Sep 14, 2026

0.11.17 patch

Aug 17, 2026

0.11.16 unknown

Jul 04, 2026

0.11.15 unknown

Jun 22, 2026

0.11.14 unknown

1 CVE

Mar 09, 2026

0.11.13 unknown

2 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 27, 2025

0.11.12 unknown

2 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

May 09, 2025

0.11.11 unknown

2 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 22, 2025

0.11.10 unknown

2 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 18, 2025

0.11.9 unknown

2 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 13, 2024

0.11.8 unknown

2 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

Sep 03, 2024

0.11.7 unknown

2 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

Sep 02, 2024

0.11.6 unknown

3 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2024-45311 GHSA-vr26-jcq5-fjj8 RUSTSEC-2024-0373 Sep 03, 2024

Denial of service in quinn-proto when using `Endpoint::retry()`

High

Network Low None None

Summary

As of quinn-proto 0.11, it is possible for a server to accept(), retry(), refuse(), or ignore() an Incoming connection. However, calling retry() on an unvalidated connection exposes the server to a likely panic in the following situations:

Calling refuse or ignore on the resulting validated connection, if a duplicate initial packet is received
- This issue can go undetected until a server's refuse()/ignore() code path is exercised, such as to stop a denial of service attack.
Accepting when the initial packet for the resulting validated connection fails to decrypt or exhausts connection IDs, if a similar initial packet that successfully decrypts and doesn't exhaust connection IDs is received.
- This issue can go undetected if clients are well-behaved.

The former situation was observed in a real application, while the latter is only theoretical.

Details

Location of panic: https://github.com/quinn-rs/quinn/blob/bb02a12a8435a7732a1d762783eeacbb7e50418e/quinn-proto/src/endpoint.rs#L213

Impact

Denial of service for internet-facing server

Fixed in


          0.11.7

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 04, 2024

0.11.5 unknown yanked

3 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2024-45311 GHSA-vr26-jcq5-fjj8 RUSTSEC-2024-0373 Sep 03, 2024

Denial of service in quinn-proto when using `Endpoint::retry()`

High

Network Low None None

Summary

As of quinn-proto 0.11, it is possible for a server to accept(), retry(), refuse(), or ignore() an Incoming connection. However, calling retry() on an unvalidated connection exposes the server to a likely panic in the following situations:

Calling refuse or ignore on the resulting validated connection, if a duplicate initial packet is received
- This issue can go undetected until a server's refuse()/ignore() code path is exercised, such as to stop a denial of service attack.
Accepting when the initial packet for the resulting validated connection fails to decrypt or exhausts connection IDs, if a similar initial packet that successfully decrypts and doesn't exhaust connection IDs is received.
- This issue can go undetected if clients are well-behaved.

The former situation was observed in a real application, while the latter is only theoretical.

Details

Location of panic: https://github.com/quinn-rs/quinn/blob/bb02a12a8435a7732a1d762783eeacbb7e50418e/quinn-proto/src/endpoint.rs#L213

Impact

Denial of service for internet-facing server

Fixed in


          0.11.7

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 04, 2024

0.11.4 unknown yanked

3 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2024-45311 GHSA-vr26-jcq5-fjj8 RUSTSEC-2024-0373 Sep 03, 2024

Denial of service in quinn-proto when using `Endpoint::retry()`

High

Network Low None None

Summary

As of quinn-proto 0.11, it is possible for a server to accept(), retry(), refuse(), or ignore() an Incoming connection. However, calling retry() on an unvalidated connection exposes the server to a likely panic in the following situations:

Calling refuse or ignore on the resulting validated connection, if a duplicate initial packet is received
- This issue can go undetected until a server's refuse()/ignore() code path is exercised, such as to stop a denial of service attack.
Accepting when the initial packet for the resulting validated connection fails to decrypt or exhausts connection IDs, if a similar initial packet that successfully decrypts and doesn't exhaust connection IDs is received.
- This issue can go undetected if clients are well-behaved.

The former situation was observed in a real application, while the latter is only theoretical.

Details

Location of panic: https://github.com/quinn-rs/quinn/blob/bb02a12a8435a7732a1d762783eeacbb7e50418e/quinn-proto/src/endpoint.rs#L213

Impact

Denial of service for internet-facing server

Fixed in


          0.11.7

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 03, 2024

0.11.3 unknown

3 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2024-45311 GHSA-vr26-jcq5-fjj8 RUSTSEC-2024-0373 Sep 03, 2024

Denial of service in quinn-proto when using `Endpoint::retry()`

High

Network Low None None

Summary

As of quinn-proto 0.11, it is possible for a server to accept(), retry(), refuse(), or ignore() an Incoming connection. However, calling retry() on an unvalidated connection exposes the server to a likely panic in the following situations:

Calling refuse or ignore on the resulting validated connection, if a duplicate initial packet is received
- This issue can go undetected until a server's refuse()/ignore() code path is exercised, such as to stop a denial of service attack.
Accepting when the initial packet for the resulting validated connection fails to decrypt or exhausts connection IDs, if a similar initial packet that successfully decrypts and doesn't exhaust connection IDs is received.
- This issue can go undetected if clients are well-behaved.

The former situation was observed in a real application, while the latter is only theoretical.

Details

Location of panic: https://github.com/quinn-rs/quinn/blob/bb02a12a8435a7732a1d762783eeacbb7e50418e/quinn-proto/src/endpoint.rs#L213

Impact

Denial of service for internet-facing server

Fixed in


          0.11.7

References

Updated Sep 10, 2026 · Source: OSV.dev

Jun 07, 2024

0.11.2 unknown

3 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2024-45311 GHSA-vr26-jcq5-fjj8 RUSTSEC-2024-0373 Sep 03, 2024

Denial of service in quinn-proto when using `Endpoint::retry()`

High

Network Low None None

Summary

As of quinn-proto 0.11, it is possible for a server to accept(), retry(), refuse(), or ignore() an Incoming connection. However, calling retry() on an unvalidated connection exposes the server to a likely panic in the following situations:

Calling refuse or ignore on the resulting validated connection, if a duplicate initial packet is received
- This issue can go undetected until a server's refuse()/ignore() code path is exercised, such as to stop a denial of service attack.
Accepting when the initial packet for the resulting validated connection fails to decrypt or exhausts connection IDs, if a similar initial packet that successfully decrypts and doesn't exhaust connection IDs is received.
- This issue can go undetected if clients are well-behaved.

The former situation was observed in a real application, while the latter is only theoretical.

Details

Location of panic: https://github.com/quinn-rs/quinn/blob/bb02a12a8435a7732a1d762783eeacbb7e50418e/quinn-proto/src/endpoint.rs#L213

Impact

Denial of service for internet-facing server

Fixed in


          0.11.7

References

Updated Sep 10, 2026 · Source: OSV.dev

May 24, 2024

0.11.1 unknown

3 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2024-45311 GHSA-vr26-jcq5-fjj8 RUSTSEC-2024-0373 Sep 03, 2024

Denial of service in quinn-proto when using `Endpoint::retry()`

High

Network Low None None

Summary

As of quinn-proto 0.11, it is possible for a server to accept(), retry(), refuse(), or ignore() an Incoming connection. However, calling retry() on an unvalidated connection exposes the server to a likely panic in the following situations:

Calling refuse or ignore on the resulting validated connection, if a duplicate initial packet is received
- This issue can go undetected until a server's refuse()/ignore() code path is exercised, such as to stop a denial of service attack.
Accepting when the initial packet for the resulting validated connection fails to decrypt or exhausts connection IDs, if a similar initial packet that successfully decrypts and doesn't exhaust connection IDs is received.
- This issue can go undetected if clients are well-behaved.

The former situation was observed in a real application, while the latter is only theoretical.

Details

Location of panic: https://github.com/quinn-rs/quinn/blob/bb02a12a8435a7732a1d762783eeacbb7e50418e/quinn-proto/src/endpoint.rs#L213

Impact

Denial of service for internet-facing server

Fixed in


          0.11.7

References

Updated Sep 10, 2026 · Source: OSV.dev

May 08, 2024

0.11.0 unknown

3 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2024-45311 GHSA-vr26-jcq5-fjj8 RUSTSEC-2024-0373 Sep 03, 2024

Denial of service in quinn-proto when using `Endpoint::retry()`

High

Network Low None None

Summary

As of quinn-proto 0.11, it is possible for a server to accept(), retry(), refuse(), or ignore() an Incoming connection. However, calling retry() on an unvalidated connection exposes the server to a likely panic in the following situations:

Calling refuse or ignore on the resulting validated connection, if a duplicate initial packet is received
- This issue can go undetected until a server's refuse()/ignore() code path is exercised, such as to stop a denial of service attack.
Accepting when the initial packet for the resulting validated connection fails to decrypt or exhausts connection IDs, if a similar initial packet that successfully decrypts and doesn't exhaust connection IDs is received.
- This issue can go undetected if clients are well-behaved.

The former situation was observed in a real application, while the latter is only theoretical.

Details

Location of panic: https://github.com/quinn-rs/quinn/blob/bb02a12a8435a7732a1d762783eeacbb7e50418e/quinn-proto/src/endpoint.rs#L213

Impact

Denial of service for internet-facing server

Fixed in


          0.11.7

References

Updated Sep 10, 2026 · Source: OSV.dev

May 06, 2024

0.10.6 unknown

2 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 07, 2023

0.9.6 unknown

2 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 09, 2023

0.10.5 unknown

2 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

Sep 20, 2023

0.9.5 unknown

2 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

Sep 20, 2023

0.10.4 unknown

2 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 24, 2023

0.10.3 unknown

2 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 20, 2023

0.10.2 unknown

2 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 02, 2023

0.9.4 unknown

3 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2023-42805 GHSA-q8wc-j5m9-27w3 RUSTSEC-2023-0063 Sep 21, 2023

Denial of Service issue in quinn-proto

7.5 / 10

High

Network Low None None Unchanged None None High

Impact

Receiving unknown QUIC frames in a QUIC packet could result in a panic.

Patches

The problem has been fixed in 0.9.5 and 0.10.5 maintenance releases.

References

Fixed in https://github.com/quinn-rs/quinn/pull/1667, backported in https://github.com/quinn-rs/quinn/pull/1668 and https://github.com/quinn-rs/quinn/pull/1669.

Fixed in


          0.9.5

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 21, 2023

0.10.1 unknown

2 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

May 11, 2023

0.10.0 unknown

2 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

May 11, 2023

0.9.3 unknown

3 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2023-42805 GHSA-q8wc-j5m9-27w3 RUSTSEC-2023-0063 Sep 21, 2023

Denial of Service issue in quinn-proto

7.5 / 10

High

Network Low None None Unchanged None None High

Impact

Receiving unknown QUIC frames in a QUIC packet could result in a panic.

Patches

The problem has been fixed in 0.9.5 and 0.10.5 maintenance releases.

References

Fixed in https://github.com/quinn-rs/quinn/pull/1667, backported in https://github.com/quinn-rs/quinn/pull/1668 and https://github.com/quinn-rs/quinn/pull/1669.

Fixed in


          0.9.5

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 28, 2023

0.9.2 unknown

3 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2023-42805 GHSA-q8wc-j5m9-27w3 RUSTSEC-2023-0063 Sep 21, 2023

Denial of Service issue in quinn-proto

7.5 / 10

High

Network Low None None Unchanged None None High

Impact

Receiving unknown QUIC frames in a QUIC packet could result in a panic.

Patches

The problem has been fixed in 0.9.5 and 0.10.5 maintenance releases.

References

Fixed in https://github.com/quinn-rs/quinn/pull/1667, backported in https://github.com/quinn-rs/quinn/pull/1668 and https://github.com/quinn-rs/quinn/pull/1669.

Fixed in


          0.9.5

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 05, 2022

0.9.1 unknown

3 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2023-42805 GHSA-q8wc-j5m9-27w3 RUSTSEC-2023-0063 Sep 21, 2023

Denial of Service issue in quinn-proto

7.5 / 10

High

Network Low None None Unchanged None None High

Impact

Receiving unknown QUIC frames in a QUIC packet could result in a panic.

Patches

The problem has been fixed in 0.9.5 and 0.10.5 maintenance releases.

References

Fixed in https://github.com/quinn-rs/quinn/pull/1667, backported in https://github.com/quinn-rs/quinn/pull/1668 and https://github.com/quinn-rs/quinn/pull/1669.

Fixed in


          0.9.5

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 16, 2022

0.9.0 unknown

3 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2023-42805 GHSA-q8wc-j5m9-27w3 RUSTSEC-2023-0063 Sep 21, 2023

Denial of Service issue in quinn-proto

7.5 / 10

High

Network Low None None Unchanged None None High

Impact

Receiving unknown QUIC frames in a QUIC packet could result in a panic.

Patches

The problem has been fixed in 0.9.5 and 0.10.5 maintenance releases.

References

Fixed in https://github.com/quinn-rs/quinn/pull/1667, backported in https://github.com/quinn-rs/quinn/pull/1668 and https://github.com/quinn-rs/quinn/pull/1669.

Fixed in


          0.9.5

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 26, 2022

0.8.4 unknown

3 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2023-42805 GHSA-q8wc-j5m9-27w3 RUSTSEC-2023-0063 Sep 21, 2023

Denial of Service issue in quinn-proto

7.5 / 10

High

Network Low None None Unchanged None None High

Impact

Receiving unknown QUIC frames in a QUIC packet could result in a panic.

Patches

The problem has been fixed in 0.9.5 and 0.10.5 maintenance releases.

References

Fixed in https://github.com/quinn-rs/quinn/pull/1667, backported in https://github.com/quinn-rs/quinn/pull/1668 and https://github.com/quinn-rs/quinn/pull/1669.

Fixed in


          0.9.5

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 12, 2022

0.8.3 unknown

3 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2023-42805 GHSA-q8wc-j5m9-27w3 RUSTSEC-2023-0063 Sep 21, 2023

Denial of Service issue in quinn-proto

7.5 / 10

High

Network Low None None Unchanged None None High

Impact

Receiving unknown QUIC frames in a QUIC packet could result in a panic.

Patches

The problem has been fixed in 0.9.5 and 0.10.5 maintenance releases.

References

Fixed in https://github.com/quinn-rs/quinn/pull/1667, backported in https://github.com/quinn-rs/quinn/pull/1668 and https://github.com/quinn-rs/quinn/pull/1669.

Fixed in


          0.9.5

References

Updated Sep 10, 2026 · Source: OSV.dev

May 25, 2022

0.8.2 unknown

3 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2023-42805 GHSA-q8wc-j5m9-27w3 RUSTSEC-2023-0063 Sep 21, 2023

Denial of Service issue in quinn-proto

7.5 / 10

High

Network Low None None Unchanged None None High

Impact

Receiving unknown QUIC frames in a QUIC packet could result in a panic.

Patches

The problem has been fixed in 0.9.5 and 0.10.5 maintenance releases.

References

Fixed in https://github.com/quinn-rs/quinn/pull/1667, backported in https://github.com/quinn-rs/quinn/pull/1668 and https://github.com/quinn-rs/quinn/pull/1669.

Fixed in


          0.9.5

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 28, 2022

0.8.1 unknown

3 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2023-42805 GHSA-q8wc-j5m9-27w3 RUSTSEC-2023-0063 Sep 21, 2023

Denial of Service issue in quinn-proto

7.5 / 10

High

Network Low None None Unchanged None None High

Impact

Receiving unknown QUIC frames in a QUIC packet could result in a panic.

Patches

The problem has been fixed in 0.9.5 and 0.10.5 maintenance releases.

References

Fixed in https://github.com/quinn-rs/quinn/pull/1667, backported in https://github.com/quinn-rs/quinn/pull/1668 and https://github.com/quinn-rs/quinn/pull/1669.

Fixed in


          0.9.5

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 19, 2022

0.8.0 unknown

3 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2023-42805 GHSA-q8wc-j5m9-27w3 RUSTSEC-2023-0063 Sep 21, 2023

Denial of Service issue in quinn-proto

7.5 / 10

High

Network Low None None Unchanged None None High

Impact

Receiving unknown QUIC frames in a QUIC packet could result in a panic.

Patches

The problem has been fixed in 0.9.5 and 0.10.5 maintenance releases.

References

Fixed in https://github.com/quinn-rs/quinn/pull/1667, backported in https://github.com/quinn-rs/quinn/pull/1668 and https://github.com/quinn-rs/quinn/pull/1669.

Fixed in


          0.9.5

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 14, 2021

0.7.3 unknown

3 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2023-42805 GHSA-q8wc-j5m9-27w3 RUSTSEC-2023-0063 Sep 21, 2023

Denial of Service issue in quinn-proto

7.5 / 10

High

Network Low None None Unchanged None None High

Impact

Receiving unknown QUIC frames in a QUIC packet could result in a panic.

Patches

The problem has been fixed in 0.9.5 and 0.10.5 maintenance releases.

References

Fixed in https://github.com/quinn-rs/quinn/pull/1667, backported in https://github.com/quinn-rs/quinn/pull/1668 and https://github.com/quinn-rs/quinn/pull/1669.

Fixed in


          0.9.5

References

Updated Sep 10, 2026 · Source: OSV.dev

May 03, 2021

0.7.2 unknown

3 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2023-42805 GHSA-q8wc-j5m9-27w3 RUSTSEC-2023-0063 Sep 21, 2023

Denial of Service issue in quinn-proto

7.5 / 10

High

Network Low None None Unchanged None None High

Impact

Receiving unknown QUIC frames in a QUIC packet could result in a panic.

Patches

The problem has been fixed in 0.9.5 and 0.10.5 maintenance releases.

References

Fixed in https://github.com/quinn-rs/quinn/pull/1667, backported in https://github.com/quinn-rs/quinn/pull/1668 and https://github.com/quinn-rs/quinn/pull/1669.

Fixed in


          0.9.5

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 04, 2021

0.7.1 unknown

3 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2023-42805 GHSA-q8wc-j5m9-27w3 RUSTSEC-2023-0063 Sep 21, 2023

Denial of Service issue in quinn-proto

7.5 / 10

High

Network Low None None Unchanged None None High

Impact

Receiving unknown QUIC frames in a QUIC packet could result in a panic.

Patches

The problem has been fixed in 0.9.5 and 0.10.5 maintenance releases.

References

Fixed in https://github.com/quinn-rs/quinn/pull/1667, backported in https://github.com/quinn-rs/quinn/pull/1668 and https://github.com/quinn-rs/quinn/pull/1669.

Fixed in


          0.9.5

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 20, 2021

0.7.0 unknown

3 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2023-42805 GHSA-q8wc-j5m9-27w3 RUSTSEC-2023-0063 Sep 21, 2023

Denial of Service issue in quinn-proto

7.5 / 10

High

Network Low None None Unchanged None None High

Impact

Receiving unknown QUIC frames in a QUIC packet could result in a panic.

Patches

The problem has been fixed in 0.9.5 and 0.10.5 maintenance releases.

References

Fixed in https://github.com/quinn-rs/quinn/pull/1667, backported in https://github.com/quinn-rs/quinn/pull/1668 and https://github.com/quinn-rs/quinn/pull/1669.

Fixed in


          0.9.5

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 02, 2021

0.6.1 unknown

3 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2023-42805 GHSA-q8wc-j5m9-27w3 RUSTSEC-2023-0063 Sep 21, 2023

Denial of Service issue in quinn-proto

7.5 / 10

High

Network Low None None Unchanged None None High

Impact

Receiving unknown QUIC frames in a QUIC packet could result in a panic.

Patches

The problem has been fixed in 0.9.5 and 0.10.5 maintenance releases.

References

Fixed in https://github.com/quinn-rs/quinn/pull/1667, backported in https://github.com/quinn-rs/quinn/pull/1668 and https://github.com/quinn-rs/quinn/pull/1669.

Fixed in


          0.9.5

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 04, 2020

0.6.0 unknown

3 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2023-42805 GHSA-q8wc-j5m9-27w3 RUSTSEC-2023-0063 Sep 21, 2023

Denial of Service issue in quinn-proto

7.5 / 10

High

Network Low None None Unchanged None None High

Impact

Receiving unknown QUIC frames in a QUIC packet could result in a panic.

Patches

The problem has been fixed in 0.9.5 and 0.10.5 maintenance releases.

References

Fixed in https://github.com/quinn-rs/quinn/pull/1667, backported in https://github.com/quinn-rs/quinn/pull/1668 and https://github.com/quinn-rs/quinn/pull/1669.

Fixed in


          0.9.5

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 12, 2020

0.5.2 unknown

3 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2023-42805 GHSA-q8wc-j5m9-27w3 RUSTSEC-2023-0063 Sep 21, 2023

Denial of Service issue in quinn-proto

7.5 / 10

High

Network Low None None Unchanged None None High

Impact

Receiving unknown QUIC frames in a QUIC packet could result in a panic.

Patches

The problem has been fixed in 0.9.5 and 0.10.5 maintenance releases.

References

Fixed in https://github.com/quinn-rs/quinn/pull/1667, backported in https://github.com/quinn-rs/quinn/pull/1668 and https://github.com/quinn-rs/quinn/pull/1669.

Fixed in


          0.9.5

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 15, 2019

0.5.0 unknown

3 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2023-42805 GHSA-q8wc-j5m9-27w3 RUSTSEC-2023-0063 Sep 21, 2023

Denial of Service issue in quinn-proto

7.5 / 10

High

Network Low None None Unchanged None None High

Impact

Receiving unknown QUIC frames in a QUIC packet could result in a panic.

Patches

The problem has been fixed in 0.9.5 and 0.10.5 maintenance releases.

References

Fixed in https://github.com/quinn-rs/quinn/pull/1667, backported in https://github.com/quinn-rs/quinn/pull/1668 and https://github.com/quinn-rs/quinn/pull/1669.

Fixed in


          0.9.5

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 03, 2019

0.4.0 unknown

3 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2023-42805 GHSA-q8wc-j5m9-27w3 RUSTSEC-2023-0063 Sep 21, 2023

Denial of Service issue in quinn-proto

7.5 / 10

High

Network Low None None Unchanged None None High

Impact

Receiving unknown QUIC frames in a QUIC packet could result in a panic.

Patches

The problem has been fixed in 0.9.5 and 0.10.5 maintenance releases.

References

Fixed in https://github.com/quinn-rs/quinn/pull/1667, backported in https://github.com/quinn-rs/quinn/pull/1668 and https://github.com/quinn-rs/quinn/pull/1669.

Fixed in


          0.9.5

References

Updated Sep 10, 2026 · Source: OSV.dev

Sep 09, 2019

0.3.0 unknown

3 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2023-42805 GHSA-q8wc-j5m9-27w3 RUSTSEC-2023-0063 Sep 21, 2023

Denial of Service issue in quinn-proto

7.5 / 10

High

Network Low None None Unchanged None None High

Impact

Receiving unknown QUIC frames in a QUIC packet could result in a panic.

Patches

The problem has been fixed in 0.9.5 and 0.10.5 maintenance releases.

References

Fixed in https://github.com/quinn-rs/quinn/pull/1667, backported in https://github.com/quinn-rs/quinn/pull/1668 and https://github.com/quinn-rs/quinn/pull/1669.

Fixed in


          0.9.5

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 18, 2019

0.2.0 unknown

3 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2023-42805 GHSA-q8wc-j5m9-27w3 RUSTSEC-2023-0063 Sep 21, 2023

Denial of Service issue in quinn-proto

7.5 / 10

High

Network Low None None Unchanged None None High

Impact

Receiving unknown QUIC frames in a QUIC packet could result in a panic.

Patches

The problem has been fixed in 0.9.5 and 0.10.5 maintenance releases.

References

Fixed in https://github.com/quinn-rs/quinn/pull/1667, backported in https://github.com/quinn-rs/quinn/pull/1668 and https://github.com/quinn-rs/quinn/pull/1669.

Fixed in


          0.9.5

References

Updated Sep 10, 2026 · Source: OSV.dev

Jan 21, 2019

0.1.0 unknown

3 CVEs

CVE-2026-25800 GHSA-4w2j-m93h-cj5j RUSTSEC-2026-0185 Jul 24, 2026

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.

Fixed in


          0.11.15

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2026-31812 GHSA-6xvm-j4wr-6v98 RUSTSEC-2026-0037 Mar 11, 2026

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

High

Network Low None None

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

Start server:

cargo run --example server -- ./

Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Fixed in


          0.11.14

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2023-42805 GHSA-q8wc-j5m9-27w3 RUSTSEC-2023-0063 Sep 21, 2023

Denial of Service issue in quinn-proto

7.5 / 10

High

Network Low None None Unchanged None None High

Impact

Receiving unknown QUIC frames in a QUIC packet could result in a panic.

Patches

The problem has been fixed in 0.9.5 and 0.10.5 maintenance releases.

References

Fixed in https://github.com/quinn-rs/quinn/pull/1667, backported in https://github.com/quinn-rs/quinn/pull/1668 and https://github.com/quinn-rs/quinn/pull/1669.

Fixed in


          0.9.5

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 02, 2018

Activity

Reach

Details