Executive brief
Quinn is a software library used by developers to implement the QUIC network protocol in Rust applications. A flaw in how it handles incoming data fragments allows a remote attacker to send specially crafted network traffic that consumes excessive amounts of memory. This can lead to a denial-of-service (DoS) condition where the application crashes or becomes unresponsive due to memory exhaustion.
Technical details
A resource exhaustion vulnerability exists in the `Assembler` component of quinn-proto, which is responsible for reassembling unordered stream fragments. When a `RecvStream` is read in order (e.g., via `AsyncRead`), the library fails to adequately limit the overhead incurred by non-contiguous fragments. An attacker can exploit this by sending fragments that intentionally leave gaps in the early parts of the stream. Because these fragmented chunks cannot be immediately defragmented or cleared, they cause high buffer overhead. This leads to unbounded memory consumption and a subsequent crash (OOM). The issue is fixed in version 0.11.15 by yielding an error when too many gaps are detected in the assembler.
Affected products
- quinn-rs quinn-proto >= 0.1.0, < 0.11.15
- quinn-rs quinn >= 0.1.0, < 0.11.15
Timeline
- 2026-06-22: patched: Fix merged in pull request 2694 and version 0.11.15 released.
- 2026-06-22: advisory: GitHub Security Advisory GHSA-4w2j-m93h-cj5j published.
- 2026-07-23: disclosed: CVE-2026-25800 published to NVD.