CVE-2026-61544

libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.13.1, libp2p-quic could panic during an inbound QUIC handshake when a remote peer presented a valid short-lived libp2p TLS certificate and delayed the final TLS 1.3 handshake fragment until after t...

CVE-2026-61544 libp2p-quic: Remote panic via certificate expiry race during QUIC handshake

libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.13.1, libp2p-quic could panic during an inbound QUIC handshake when a remote peer presented a valid short-lived libp2p TLS certificate and delayed the final TLS 1.3 handshake fragment until after t...

Remote peer can panic quinn-proto with zero-length STREAM frames during unordered reads

When a stream is read in unordered mode for example through RecvStream::readfalse in quinn-proto or readunordered in quinn, quinn-proto proactively deduplicates received data by recording received ranges in a RangeSet through its replace method. When an incoming STREAM frame carried an empty...

Outgoing datagram buffer accounting can panic the sender in quinn-proto

The limit on memory used to buffer outgoing datagrams, introduced in 0.11.17, subtracted an evicted datagram's size from the buffered byte counter twice when Datagrams::send was called with drop = true as Connection::senddatagram in the quinn crate does while the buffer was full. Under sustained...

Peer minimum ACK delay can panic quinn-proto when ACK_FREQUENCY transmission is enabled

When sending ACKFREQUENCY frames is enabled through TransportConfig::ackfrequencyconfigSome.., the peer's transport parameters could cause AckFrequencyState::candidatemaxackdelay to call Duration::clamp with a minimum greater than its maximum, which panics. For example, a peer advertising a...

RUSTSEC-2026-0338 Remote peer can panic quinn-proto with zero-length STREAM frames during unordered reads

When a stream is read in unordered mode for example through RecvStream::readfalse in quinn-proto or readunordered in quinn, quinn-proto proactively deduplicates received data by recording received ranges in a RangeSet through its replace method. When an incoming STREAM frame carried an empty...

RUSTSEC-2026-0340 Peer minimum ACK delay can panic quinn-proto when ACK_FREQUENCY transmission is enabled

When sending ACKFREQUENCY frames is enabled through TransportConfig::ackfrequencyconfigSome.., the peer's transport parameters could cause AckFrequencyState::candidatemaxackdelay to call Duration::clamp with a minimum greater than its maximum, which panics. For example, a peer advertising a...

RUSTSEC-2026-0343 Outgoing datagram buffer accounting can panic the sender in quinn-proto

The limit on memory used to buffer outgoing datagrams, introduced in 0.11.17, subtracted an evicted datagram's size from the buffered byte counter twice when Datagrams::send was called with drop = true as Connection::senddatagram in the quinn crate does while the buffer was full. Under sustained...

CVE-2026-25800

A flaw was found in Quinn, a Rust implementation of the QUIC transport protocol. A remote attacker can exploit this vulnerability by sending specially crafted QUIC stream fragments with many gaps. This can lead to high buffer overhead in the Assembler component, causing memory exhaustion and a...

RUSTSEC-2026-0341 Stream reassembly memory-exhaustion guard in quinn-proto can be bypassed

The fix for RUSTSEC-2026-0185 in 0.11.15 added a cap on the number of chunks buffered by the Assembler that reassembles out-of-order stream data. However, the cap was only checked inside the branch that triggers defragmentation, which only runs when the estimated over-allocation exceeds a thresho...

Zero-length DATAGRAM frames bypass the receive buffer limit in quinn-proto

quinn-proto bounds its queue of received datagrams by charging each queued frame's payload length against TransportConfig::datagramreceivebuffersize, evicting the oldest datagrams when the limit is exceeded. A DATAGRAM frame with an empty payload was charged zero bytes, so it never triggered...

Unbounded growth of pending connection ID retirements in quinn-proto

When processing a NEWCONNECTIONID frame, quinn-proto queues a RETIRECONNECTIONID frame for each connection ID that the peer asked it to retire. The normal path bounds this queue and closes the connection with a CONNECTIONIDLIMITERROR if the bound would be exceeded. However, the path handling a...

Stream reassembly memory-exhaustion guard in quinn-proto can be bypassed

The fix for RUSTSEC-2026-0185 in 0.11.15 added a cap on the number of chunks buffered by the Assembler that reassembles out-of-order stream data. However, the cap was only checked inside the branch that triggers defragmentation, which only runs when the estimated over-allocation exceeds a thresho...

RUSTSEC-2026-0339 Unbounded growth of pending connection ID retirements in quinn-proto

When processing a NEWCONNECTIONID frame, quinn-proto queues a RETIRECONNECTIONID frame for each connection ID that the peer asked it to retire. The normal path bounds this queue and closes the connection with a CONNECTIONIDLIMITERROR if the bound would be exceeded. However, the path handling a...

RUSTSEC-2026-0342 Zero-length DATAGRAM frames bypass the receive buffer limit in quinn-proto

quinn-proto bounds its queue of received datagrams by charging each queued frame's payload length against TransportConfig::datagramreceivebuffersize, evicting the oldest datagrams when the limit is exceeded. A DATAGRAM frame with an empty payload was charged zero bytes, so it never triggered...

SUSE CVE-2026-25800

Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and prior to version 0.11.15, the Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous...

Linux Distros Unpatched Vulnerability : CVE-2026-25800

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and prior to version 0.11.15, the Assembler...

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

Summary The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order through an AsyncRead impl for example will be sensitive to peers that send fragments whil...

DEBIAN-CVE-2026-25800

Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and prior to version 0.11.15, the Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous...

CVE-2026-25800

Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and prior to version 0.11.15, the Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous...