Description
Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Prior to 0.11.14, a remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication. This vulnerability is fixed in 0.11.14.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| quinn-rs | quinn | < 0.11.14 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rust-quinn-proto | 0.11.14-1 | — |
| Debian 13 | rust-quinn-proto | No fix yet | — |
| Debian 12 | rust-quinn-proto | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | rust-quinn-proto | No fix yet | — |
| Ubuntu 26.04 LTS | rust-quinn-proto | No fix yet | — |
| Ubuntu 25.10 | rust-quinn-proto | No fix yet | — |
| Ubuntu 24.04 LTS | rust-quinn-proto | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | rust | 1.94.0-150500.27.65.1 | SUSE-RU-2026:1001-1 |
| SLES 15 SP7 | rust1.92 | 1.92.0-150300.7.6.1 | SUSE-SU-2026:1337-1 |
| SLES 15 SP7 | rust1.93 | 1.93.0-150300.7.6.1 | SUSE-SU-2026:1415-1 |
| SLES 15 SP7 | rust1.94 | 1.94.0-150300.7.6.1 | SUSE-RU-2026:1001-1 |
| SLES 15 SP6 | rust | 1.94.0-150500.27.65.1 | SUSE-RU-2026:1001-1 |
| SLES 15 SP6 | rust1.94 | 1.94.0-150300.7.6.1 | SUSE-RU-2026:1001-1 |
| SLES 15 SP5 | rust | 1.94.0-150500.27.65.1 | SUSE-RU-2026:1001-1 |
| SLES 15 SP5 | rust1.94 | 1.94.0-150300.7.6.1 | SUSE-RU-2026:1001-1 |
| SLES 15 SP4 | rust | 1.94.0-150400.24.71.1 | SUSE-RU-2026:1001-1 |
| SLES 15 SP4 | rust1.94 | 1.94.0-150300.7.6.1 | SUSE-RU-2026:1001-1 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | python-uv | 0.7.18-160000.5.1 | SUSE-SU-2026:22005-1 |
| SLES for SAP 15 SP6 | rust | 1.94.0-150500.27.65.1 | SUSE-RU-2026:1001-1 |
| SLES for SAP 15 SP6 | rust1.94 | 1.94.0-150300.7.6.1 | SUSE-RU-2026:1001-1 |
| SLES for SAP 15 SP5 | rust | 1.94.0-150500.27.65.1 | SUSE-RU-2026:1001-1 |
| SLES for SAP 15 SP5 | rust1.94 | 1.94.0-150300.7.6.1 | SUSE-RU-2026:1001-1 |
| SLES for SAP 15 SP4 | rust | 1.94.0-150400.24.71.1 | SUSE-RU-2026:1001-1 |
| SLES for SAP 15 SP4 | rust1.94 | 1.94.0-150300.7.6.1 | SUSE-RU-2026:1001-1 |
| SLES 16.0 | python-uv | 0.7.18-160000.5.1 | SUSE-SU-2026:22005-1 |
| SLE HPC 15 SP5 | rust | 1.94.0-150500.27.65.1 | SUSE-RU-2026:1001-1 |
| SLE HPC 15 SP5 | rust1.94 | 1.94.0-150300.7.6.1 | SUSE-RU-2026:1001-1 |
| SLE HPC 15 SP4 | rust | 1.94.0-150400.24.71.1 | SUSE-RU-2026:1001-1 |
| SLE HPC 15 SP4 | rust1.94 | 1.94.0-150300.7.6.1 | SUSE-RU-2026:1001-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-uv | 0.10.11-1.1 | openSUSE-SU-2026:10380-1 |
| openSUSE Tumbleweed | rust1.92 | 1.92.0-2.1 | openSUSE-SU-2026:10382-1 |
| openSUSE Tumbleweed | rust1.93 | 1.93.0-3.1 | openSUSE-SU-2026:10383-1 |
| openSUSE Tumbleweed | rust1.94 | 1.94.0-2.1 | openSUSE-SU-2026:10384-1 |
| openSUSE Leap 16.0 | rust1.94 | 1.94.1-160000.1.1 | openSUSE-SU-2026:20569-1 |
| openSUSE Leap 15.6 | rust | 1.94.0-150500.27.65.1 | SUSE-RU-2026:1001-1 |
| openSUSE Leap 15.6 | rust1.92 | 1.92.0-150300.7.6.1 | SUSE-SU-2026:1337-1 |
| openSUSE Leap 15.6 | rust1.93 | 1.93.0-150300.7.6.1 | SUSE-SU-2026:1415-1 |
| openSUSE Leap 15.6 | rust1.94 | 1.94.0-150300.7.6.1 | SUSE-RU-2026:1001-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | berg | 0.5.5-r2 | — |
| Wolfi rolling | lychee | 0.23.0-r2 | — |
| Wolfi rolling | nushell +1 | 0.111.0-r4 | — |
| Wolfi rolling | parseable | 2.5.14-r2 | — |
| Wolfi rolling | pixi | 0.65.0-r2 | — |
| Wolfi rolling | py3.10-hf-xet +3 | 1.4.0-r1 | — |
| Wolfi rolling | qdrant | 1.17.0-r2 | — |
| Wolfi rolling | samply | 0.13.1-r10 | — |
| Wolfi rolling | sccache | 0.14.0-r2 | — |
| Wolfi rolling | uv | 0.10.9-r1 | — |
| Wolfi rolling | vector | 0.54.0-r3 | — |
| Wolfi rolling | wadm | 0.21.1-r5 | — |
| Wolfi rolling | wash | 0.39.0-r9 | — |
| Wolfi rolling | wasmcloud | 1.9.2-r2 | — |
| Wolfi rolling | xh | 0.25.3-r4 | — |
| Wolfi rolling | zed | 0.226.5-r1 | — |
| Wolfi rolling | zizmor | 1.23.1-r2 | — |
| Wolfi rolling | zola +1 | 0.22.1-r3 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | quinn-proto | < 0.11.14 | 0.11.14 | GHSA-6xvm-j4wr-6v98 |
| crates.io | quinn-proto | >= 0.5.0, < 0.11.14 | 0.11.14 | RUSTSEC-2026-0037 |
Advisories 9
- SUSE-SU-2026:22005-1 Security update for python-uv SUSE / openSUSE Security Updates · Jun 9, 2026
- openSUSE-SU-2026:20569-1 Security update for rust1.94 SUSE / openSUSE Security Updates · Apr 22, 2026
- SUSE-SU-2026:1415-1 Security update for rust1.93 SUSE / openSUSE Security Updates · Apr 17, 2026
- SUSE-SU-2026:1337-1 Security update for rust1.92 SUSE / openSUSE Security Updates · Apr 16, 2026
- SUSE-RU-2026:1001-1 Recommended update for rust1.94 SUSE / openSUSE Security Updates · Mar 26, 2026
- openSUSE-SU-2026:10380-1 python311-uv-0.10.11-1.1 on GA media SUSE / openSUSE Security Updates · Mar 18, 2026
- openSUSE-SU-2026:10382-1 cargo1.92-1.92.0-2.1 on GA media SUSE / openSUSE Security Updates · Mar 18, 2026
- openSUSE-SU-2026:10384-1 cargo1.94-1.94.0-2.1 on GA media SUSE / openSUSE Security Updates · Mar 18, 2026
- openSUSE-SU-2026:10383-1 cargo1.93-1.93.0-3.1 on GA media SUSE / openSUSE Security Updates · Mar 18, 2026