Description
Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Prior to 0.11.14, a remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication. This vulnerability is fixed in 0.11.14.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
quinn-rs quinn
< 0.11.14affected
References
- https://github.com/quinn-rs/quinn/security/advisories/GHSA-6xvm-j4wr-6v98 ↗
- https://access.redhat.com/security/cve/CVE-2026-31812 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=2446330 ↗
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31812.json ↗
- https://access.redhat.com/errata/RHSA-2026:22862 ↗
- https://access.redhat.com/errata/RHSA-2026:13545 ↗
- https://access.redhat.com/errata/RHSA-2026:19712 ↗
- https://access.redhat.com/errata/RHSA-2026:5459 ↗