12 results · Feed
-
Unscored —
MAX_STREAM_DATA frame can open streams beyond the stream limit
When a MAX_STREAM_DATA frame named a peer-initiated bidirectional stream that was not open yet, `received_max_stream_data` treated the stream, and every lower-numbered stream, as opened without checking the stream ID against the limit advertised to the peer. …
-
Unscored —
Long Retry token can panic or exhaust memory in a QUIC client
A client kept the token from a Retry packet without any length limit and put it into the header of every Initial packet it sent afterwards. Initial datagrams are 1200 bytes. When the token and connection IDs left no room for the minimum payload, `PacketBuilde…
-
High 7.5
Outgoing datagram buffer accounting can panic the sender in quinn-proto
The limit on memory used to buffer outgoing datagrams, introduced in 0.11.17, subtracted an evicted datagram's size from the buffered byte counter twice when `Datagrams::send` was called with `drop = true` (as `Connection::send_datagram` in the `quinn` crate …
-
High 7.5
Peer minimum ACK delay can panic quinn-proto when ACK_FREQUENCY transmission is enabled
When sending ACK_FREQUENCY frames is enabled through `TransportConfig::ack_frequency_config(Some(..))`, the peer's transport parameters could cause `AckFrequencyState::candidate_max_ack_delay` to call `Duration::clamp` with a minimum greater than its maximum,…
-
Unscored —
Remote peer can panic quinn-proto with zero-length STREAM frames during unordered reads
When a stream is read in unordered mode (for example through `RecvStream::read(false)` in quinn-proto or `read_unordered` in `quinn`), quinn-proto proactively deduplicates received data by recording received ranges in a `RangeSet` through its `replace` method…
-
Unscored —
Zero-length DATAGRAM frames bypass the receive buffer limit in quinn-proto
quinn-proto bounds its queue of received datagrams by charging each queued frame's payload length against `TransportConfig::datagram_receive_buffer_size`, evicting the oldest datagrams when the limit is exceeded. A DATAGRAM frame with an empty payload was cha…
-
High 7.5
Stream reassembly memory-exhaustion guard in quinn-proto can be bypassed
The fix for RUSTSEC-2026-0185 in 0.11.15 added a cap on the number of chunks buffered by the `Assembler` that reassembles out-of-order stream data. However, the cap was only checked inside the branch that triggers defragmentation, which only runs when the est…
-
Unscored —
Unbounded growth of pending connection ID retirements in quinn-proto
When processing a NEW_CONNECTION_ID frame, quinn-proto queues a RETIRE_CONNECTION_ID frame for each connection ID that the peer asked it to retire. The normal path bounds this queue and closes the connection with a CONNECTION_ID_LIMIT_ERROR if the bound would…
-
High 7.5
quinn-proto has remote memory exhaustion from unbounded out-of-order stream reassembly
Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and prior to version 0.11.15, the `Assembler` component that assembles unordered stream fragments into consecutive chunks of the stream incurs…
-
High 8.7
Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing
Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Prior to 0.11.14, a remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial p…
-
High 7.5
Denial of service in quinn-proto when using `Endpoint::retry()`
Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. As of quinn-proto 0.11, it is possible for a server to `accept()`, `retry()`, `refuse()`, or `ignore()` an `Incoming` connection. However, calling `retry()` on an unval…
-
High 7.5
quinn-proto Denial of Service vulnerability
quinn-proto is a state machine for the QUIC transport protocol. Prior to versions 0.9.5 and 0.10.5, receiving unknown QUIC frames in a QUIC packet could result in a panic. The problem has been fixed in 0.9.5 and 0.10.5 maintenance releases.