Skip to content
OpenAdvisories
High · 7.5 CVE-2026-25800 EUVD-2026-48374GHSA-4w2j-m93h-cj5jRUSTSEC-2026-0185

quinn-proto has remote memory exhaustion from unbounded out-of-order stream reassembly

Published Jul 23, 2026 · Updated Jul 23, 2026 · Assigned by GitHub_M

Description

Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and prior to version 0.11.15, the `Assembler` component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a `RecvStream` in order (through an `AsyncRead` impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion. Version 0.11.15 fixes the issue.

Affected products

VendorProductAffectedFixed
quinn-rs quinn >= 0.1.0, < 0.11.15 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 rust-quinn-proto 0.11.16-1 —
Debian 13 rust-quinn-proto No fix yet —
Debian 12 rust-quinn-proto No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 rust-quinn-proto No fix yet —
Ubuntu 26.04 LTS rust-quinn-proto No fix yet —
Ubuntu 24.04 LTS rust-quinn-proto No fix yet —
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed openai-codex 0.152.0-1.1 openSUSE-SU-2026:11662-1
openSUSE Tumbleweed python-uv 0.12.7-1.1 openSUSE-SU-2026:11635-1
openSUSE Leap 16.0 openai-codex 0.154.0-bp160.1.1 openSUSE-SU-2026:21870-1

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io quinn-proto >= 0.1.0, < 0.11.15 0.11.15 GHSA-4w2j-m93h-cj5j
crates.io quinn-proto >= 0.0.0-0, < 0.11.15 0.11.15 RUSTSEC-2026-0185

Advisories 3

References