Quinn
Monthly
Remote memory-exhaustion denial of service in the Quinn Rust QUIC library (quinn-proto 0.1.0 through 0.11.14) lets an unauthenticated peer flood a connection with many small, non-contiguous stream fragments that leave gaps at the start of the stream. Because the in-order Assembler cannot defragment these gapped chunks, buffer overhead grows unbounded and the receiving process can be driven to exhaust memory. CVSS 7.5 (availability-only); no public exploit identified at time of analysis, but the fix and root cause are fully documented in the upstream advisory and PR.
Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
quinn-proto is a state machine for the QUIC transport protocol. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in the quinn crate before 0.7.0 for Rust. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.
Remote memory-exhaustion denial of service in the Quinn Rust QUIC library (quinn-proto 0.1.0 through 0.11.14) lets an unauthenticated peer flood a connection with many small, non-contiguous stream fragments that leave gaps at the start of the stream. Because the in-order Assembler cannot defragment these gapped chunks, buffer overhead grows unbounded and the receiving process can be driven to exhaust memory. CVSS 7.5 (availability-only); no public exploit identified at time of analysis, but the fix and root cause are fully documented in the upstream advisory and PR.
Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
quinn-proto is a state machine for the QUIC transport protocol. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in the quinn crate before 0.7.0 for Rust. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.