Executive brief
Quinn is a software library used by applications to communicate using the QUIC internet protocol. A remote attacker can send a single specially crafted data packet to a server using this library, causing the application to crash immediately. This results in a denial of service, potentially disrupting business operations and service availability for customers without requiring any login credentials.
Technical details
A denial of service vulnerability exists in quinn-proto due to an uncaught exception (panic) during the parsing of QUIC transport parameters. The root cause is the use of the `unwrap()` method on a fallible varint decoding operation; when a truncated or malformed varint is encountered, the decoder returns an `UnexpectedEnd` error, which triggers a thread panic. An unauthenticated remote attacker can exploit this by sending a single crafted QUIC Initial packet containing malformed `quic_transport_parameters`. The vulnerability is fixed in version 0.11.14 of the Quinn library.
Affected products
- quinn-rs quinn-proto < 0.11.14
- Red Hat Red Hat Ansible Automation Platform 2.6
- Red Hat Red Hat OpenShift Container Platform 4
- Red Hat Red Hat Enterprise Linux 9, 10
Timeline
- 2026-03-09: advisory: GitHub Security Advisory GHSA-6xvm-j4wr-6v98 published
- 2026-03-10: disclosed: CVE-2026-31812 published to NVD
- 2026-05-04: patched: Red Hat released security updates for Ansible Automation Platform
References
- https://github.com/quinn-rs/quinn/security/advisories/GHSA-6xvm-j4wr-6v98
- https://access.redhat.com/errata/RHSA-2026:13545
- https://access.redhat.com/errata/RHSA-2026:19712
- https://access.redhat.com/errata/RHSA-2026:22862
- https://access.redhat.com/errata/RHSA-2026:5459
- https://access.redhat.com/security/cve/CVE-2026-31812
- https://bugzilla.redhat.com/show_bug.cgi?id=2446330