What is the CVSS score of CVE-2026-25800?

CVE-2026-25800 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Quinn are affected by CVE-2026-25800?

The Quinn Rust QUIC library (versions 0.1.0-0.11.14) contains a memory exhaustion vulnerability allowing unauthenticated denial-of-service attacks against affected systems, with no public exploit…. A patch is available.

How to fix or mitigate CVE-2026-25800?

Within 24 hours, audit all systems and applications using Quinn library versions 0.1.0 through 0.11.14 to determine exposure scope and whether they receive untrusted QUIC traffic. Within 7 days, implement interim technical controls including stream fragment rate limiting at the application layer, deploy enhanced monitoring for memory exhaustion patterns, and evaluate network segmentation to restrict QUIC access where business operations allow. Within 30 days, coordinate with vendors and library maintainers to confirm whether patched Quinn versions are available, test any updates in staging, and deploy mitigations to all affected production systems.

Quinn CVE-2026-25800

EUVD-2026-48374 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-07-23 GitHub_M

Denial Of Service Red Hat Suse Quinn

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable, unauthenticated, low-complexity fragment flood with no user interaction; impact is availability-only memory exhaustion, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jul 23, 2026 - 23:03 EUVD

Source Code Evidence Fetched

Jul 23, 2026 - 19:48 vuln.today

Analysis Generated

Jul 23, 2026 - 19:48 vuln.today

CVE Published

Jul 23, 2026 - 19:09 cve.org

HIGH 7.5

DescriptionCVE.org

Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and prior to version 0.11.15, the Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion. Version 0.11.15 fixes the issue.

AnalysisAI

Remote memory-exhaustion denial of service in the Quinn Rust QUIC library (quinn-proto 0.1.0 through 0.11.14) lets an unauthenticated peer flood a connection with many small, non-contiguous stream fragments that leave gaps at the start of the stream. Because the in-order Assembler cannot defragment these gapped chunks, buffer overhead grows unbounded and the receiving process can be driven to exhaust memory. CVSS 7.5 (availability-only); no public exploit identified at time of analysis, but the fix and root cause are fully documented in the upstream advisory and PR.

Technical ContextAI

Quinn is a pure-Rust, async implementation of the IETF QUIC transport protocol (cpe:2.3:a:quinn-rs:quinn). QUIC streams deliver data as offset-tagged fragments that may arrive out of order; the quinn-proto Assembler (quinn-proto/src/connection/assembler.rs) reassembles these into consecutive byte ranges for consumers that read in order via RecvStream/AsyncRead. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): the Assembler stored each non-contiguous fragment as a separate buffered chunk with no cap on how many chunks could accumulate. When early bytes are deliberately withheld, no defragmentation can occur, so an attacker who sends many small, gapped fragments forces the buffer set to grow proportionally to attacker input. The 0.11.15 fix adds a TooManyChunks error and rejects the stream once buffered chunk count exceeds 1024 after defragmentation (the maintainers reference ngtcp2's 4000-chunk threshold and chose a more conservative bound).

RemediationAI

Vendor-released patch: quinn-proto 0.11.15 - upgrade the quinn/quinn-proto dependency to 0.11.15 or later and run cargo update to pull the fixed crate, as directed by advisory GHSA-4w2j-m93h-cj5j and RUSTSEC-2026-0185. The fix caps buffered non-contiguous chunks and returns a TooManyChunks error, closing the connection rather than growing memory unbounded (see PR https://github.com/quinn-rs/quinn/pull/2694). If immediate upgrade is not possible, compensating controls include enforcing lower per-connection and per-stream flow-control/receive-window limits to bound how much unassembled data a peer can buffer, applying OS- or container-level memory limits (cgroups) so a single connection cannot exhaust host memory, and rate-limiting or restricting untrusted QUIC clients at the network edge; the trade-off is that aggressive window/memory limits can degrade legitimate high-latency or lossy connections and network-level restrictions reduce reachability for valid clients.

More in Quinn

View all

CVE-2024-45311 HIGH This Week

7.5 Sep 02

Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Rated high severity (CVSS 7.5

CVE-2023-42805 HIGH This Week

7.5 Sep 21

quinn-proto is a state machine for the QUIC transport protocol. Rated high severity (CVSS 7.5), this vulnerability is re

CVE-2021-28036 HIGH This Week

7.5 Mar 05

An issue was discovered in the quinn crate before 0.7.0 for Rust. Rated high severity (CVSS 7.5), this vulnerability is

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all

CVE-2017-8779 HIGH POC

7.5

CVE-2025-53521 CRITICAL POC

9.3

CVE-2017-5850 HIGH POC

7.5

CVE-2025-26682 HIGH

7.5

CVE-2025-41770 HIGH

8.7

CVE-2025-26466 MEDIUM

5.9

CVE-2020-37067 CRITICAL POC

9.8

CVE-2021-47875 CRITICAL POC

9.8

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected

CVE-2026-25800 vulnerability details – vuln.today

Back

Quinn CVE-2026-25800

Severity by source

CVSS VectorVendor: GitHub_M

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Quinn

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code