CVE-2026-31812

Summary

A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Details

The issue is panic-on-untrusted-input in QUIC transport parameter parsing. In quinn-proto (observed in quinn-proto 0.11.13), parsing of some transport parameters uses a fallible varint decode followed by unwrap(). For malformed/truncated parameter values, decode returns UnexpectedEnd, and unwrap() panics.

Observed output:

thread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

PoC

Reproduces against the upstream Quinn server example.

1. Start server:

cargo run --example server -- ./

2. Prepare PoC client environment:

python3 -m venv .venv
source .venv/bin/activate
pip install aioquic

3. Run PoC script attack.py against server QUIC listener (default example target shown):

python attack.py

Observed output

thread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:
called `Result::unwrap()` on an `Err` value: UnexpectedEnd

Impact

Vulnerability type: Remote Denial of Service (panic/crash) Attack requirements: Network reachability to UDP QUIC listener Authentication/privileges: None Who is impacted: Any server/application using affected quinn/quinn-proto versions where this parse path is reachable; process-level impact depends on integration panic handling policy

This vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program

Receiving QUIC transport parameters containing invalid values could lead to a panic.

Unfortunately the maintainers did not properly assess usage of unwrap() calls in the transport parameters parsing code, and we did not have sufficient fuzzing coverage to find this issue. We have since added a fuzzing target to cover this code path.

Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Prior to 0.11.14, a remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication. This vulnerability is fixed in 0.11.14.

These are all security issues fixed in the python311-uv-0.10.11-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the cargo1.92-1.92.0-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the cargo1.93-1.93.0-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the cargo1.94-1.94.0-2.1 package on the GA media of openSUSE Tumbleweed.

This update for rust1.94 fixes the following issues:

Changes in rust1.94:

• Don't force gcc-15 on SLE-16 and higher (bsc#1261876)

Update to rust1.94.1:

• Release notes can be found externally: https://github.com/rust-lang/rust/releases/tag/1.94.1

• Avoid unwrapping varint decoding during parameters parsing (bsc#1259623 CVE-2026-31812).

• Release notes can be found externally: https://github.com/rust-lang/rust/releases/tag/1.94.0

This update for python-uv fixes the following issues:

• CVE-2026-31812: quinn-proto: denial of service via crafted QUIC initial packet (bsc#1259624).
• CVE-2026-32766: astral-tokio-tar: malformed PAX extensions can lead to archive misinterpretation (bsc#1259966).

This update for rust1.94 fixes the following issues:

This update adds rust1.94.

Release notes can be found externally: https://github.com/rust-lang/rust/releases/tag/1.94.0

• CVE-2026-31812: avoid unwrapping varint decoding during parameters parsing (bsc#1259623)

This update for rust1.92 fixes the following issues:

• CVE-2026-31812: Denial of service via crafted QUIC initial packet (bsc#1259623).

This update for rust1.93 fixes the following issues:

Security issue:

• CVE-2026-31812: denial of service via crafted QUIC initial packet (bsc#1259623).

Non security issue:

• Resolve missing gcc requirement that may affect some crate buildin (bsc#1253321).

This update for rust1.94 fixes the following issues:

Changes in rust1.94:

• Don't force gcc-15 on SLE-16 and higher (bsc#1261876)

Update to rust1.94.1:

• Release notes can be found externally: https://github.com/rust-lang/rust/releases/tag/1.94.1

• Avoid unwrapping varint decoding during parameters parsing (bsc#1259623 CVE-2026-31812).

• Release notes can be found externally: https://github.com/rust-lang/rust/releases/tag/1.94.0

This update for python-uv fixes the following issues:

• CVE-2026-31812: quinn-proto: denial of service via crafted QUIC initial packet (bsc#1259624).
• CVE-2026-32766: astral-tokio-tar: malformed PAX extensions can lead to archive misinterpretation (bsc#1259966).