Quinn quinn-proto memory exhaustion in stream reassembly

Executive brief

A vulnerability in the Quinn networking library can allow a remote attacker to crash a server by exhausting its memory. The issue occurs when the library tries to process network data sent in a specific, fragmented way that forces the system to use excessive resources. This can lead to a denial-of-service, making the affected application or service unavailable to legitimate users.

Technical details

A resource exhaustion vulnerability (CWE-770) exists in the Assembler component of quinn-proto. The root cause is the unbounded overhead incurred when reassembling non-contiguous stream fragments. An unauthenticated remote attacker can exploit this by sending stream fragments with numerous gaps, which prevents effective defragmentation and leads to high buffer overhead. This eventually results in memory exhaustion and a denial-of-service. The vulnerability is addressed in version 0.11.15.

Affected products

• quinn-rs quinn-proto >= 0.1.0, < 0.11.15

Timeline

• 2026-06-22: disclosed: Initial disclosure by reporter
• 2026-06-22: patched: Version 0.11.15 released
• 2026-07-24: advisory: GitHub Advisory published

References

• https://api.github.com/users/K-Rintaro
• https://github.com/K-Rintaro
• https://api.github.com/users/K-Rintaro/gists%7B/gist_id%7D
• https://api.github.com/users/K-Rintaro/repos
• https://avatars.githubusercontent.com/u/70018855?v=4
• https://api.github.com/users/K-Rintaro/events%7B/privacy%7D