CVE-2026-61544

libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.13.1, libp2p-quic could panic during an inbound QUIC handshake when a remote peer presented a valid short-lived libp2p TLS certificate and delayed the final TLS 1.3 handshake fragment until after t...

CVE-2026-61544 libp2p-quic: Remote panic via certificate expiry race during QUIC handshake

libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.13.1, libp2p-quic could panic during an inbound QUIC handshake when a remote peer presented a valid short-lived libp2p TLS certificate and delayed the final TLS 1.3 handshake fragment until after t...

CVE-2026-25800

A flaw was found in Quinn, a Rust implementation of the QUIC transport protocol. A remote attacker can exploit this vulnerability by sending specially crafted QUIC stream fragments with many gaps. This can lead to high buffer overhead in the Assembler component, causing memory exhaustion and a...

SUSE CVE-2026-25800

Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and prior to version 0.11.15, the Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous...

Linux Distros Unpatched Vulnerability : CVE-2026-25800

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and prior to version 0.11.15, the Assembler...

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

Summary The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order through an AsyncRead impl for example will be sensitive to peers that send fragments whil...

actix-remote (0.1.0), agnostic (>=0.2.5, <=0.2.6) +264 more potentially affected by CVE-2026-25800 via quinn-proto (>=0.2.0, <=0.11.9)

quinn-proto CARGO version =0.2.0, =0.2.5, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.5.0, =2.0.0, =0.2.3, =0.2.11 and more Source cves: CVE-2026-25800 Source advisory: OSV:GHSA-4W2J-M93H-CJ5J...

DEBIAN-CVE-2026-25800

Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and prior to version 0.11.15, the Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous...

CVE-2026-25800

Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and prior to version 0.11.15, the Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous...

CVE-2026-25800 quinn-proto has remote memory exhaustion from unbounded out-of-order stream reassembly

Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and prior to version 0.11.15, the Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous...

CVE-2026-25800

Quinn-quic: The Assembler handling unordered stream fragments can cause high memory overhead and potential memory exhaustion for non-contiguous fragments when reading RecvStream via AsyncRead, in versions 0.1.0 through 0.11.14. The issue arises from overhead in defragmentation of fragments with g...

CVE-2026-25800

Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and prior to version 0.11.15, the Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous...

CVE-2026-25800 quinn-proto has remote memory exhaustion from unbounded out-of-order stream reassembly

Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and prior to version 0.11.15, the Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous...

CVE-2026-25800: Allocation of Resources Without Limits or Throttling

Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and prior to version 0.11.15, the Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous...

RUSTSEC-2026-0185 Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order through an AsyncRead impl for example will be sensitive to peers that send fragments while leavin...

Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order through an AsyncRead impl for example will be sensitive to peers that send fragments while leavin...

actix-remote (0.1.0), agnostic (>=0.2.5, <=0.2.6) +264 more potentially affected by CVE-2026-25800 via quinn-proto (>=0.2.0, <=0.11.9)

quinn-proto CARGO version =0.2.0, =0.2.5, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.5.0, =2.0.0, =0.2.3, =0.2.11 and more Source cves: CVE-2026-25800 Source advisory: OSV:RUSTSEC-2026-0185...

PT-2026-64151

Name of the Vulnerable Software and Affected Versions Quinn versions 0.1.0 through 0.11.14 Description The Assembler component, which organizes unordered stream fragments into consecutive chunks, incurs significant overhead when processing non-contiguous fragments. When a reader accesses a...

Fedora 43 : bpfman (2026-2fef29d32a)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-2fef29d32a advisory. Fix CVE-2026-31812: Bump quinn-proto to 0.11.14 - Closes rhbz2446359 Tenable has extracted the preceding description block directly from the Fedora security...

SUSE CVE-2026-31812

Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Prior to 0.11.14, a remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed...