GHSA-465w-v9q3-7j98
Remote peer can panic quinn-proto with zero-length STREAM frames during unordered reads
GHSA-465w-v9q3-7j98 is a vulnerability with no CVSS score yet in quinn-proto, published September 14, 2026. No source lists public exploit code. Fixed in quinn-proto 0.11.18.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.11.18quinn-proto
Description
When a stream is read in unordered mode (for example through RecvStream::read(false) in
quinn-proto or read_unordered in quinn), quinn-proto proactively deduplicates received data
by recording received ranges in a RangeSet through its replace method. When an incoming
STREAM frame carried an empty payload, the Drop implementation of the iterator returned by
replace inserted an empty range into the set, violating the invariant that stored ranges are
non-empty. Subsequent frames overlapping that region then caused a panic while processing the
stream.
A remote peer can trigger this with five small STREAM frames (two of them zero-length) once the application has put the stream in unordered-read mode. The default ordered read path is not affected.
The flaw was corrected in 0.11.18 by ignoring empty ranges in RangeSet::replace.
Thanks to Otto Hermann (@ojhermann) for reporting this issue.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
quinn-protocrates.io | 0.7.0 up to 0.11.18 | 0.11.18 |
What each source reports
OSVRUSTSEC-2026-0338No score
Remote peer can panic quinn-proto with zero-length STREAM frames during unordered reads
When a stream is read in unordered mode (for example through RecvStream::read(false) in
quinn-proto or read_unordered in quinn), quinn-proto proactively deduplicates received data
by recording received ranges in a RangeSet through its replace method. When an incoming
STREAM frame carried an empty payload, the Drop implementation of the iterator returned by
replace inserted an empty range into the set, violating the invariant that stored ranges are
non-empty. Subsequent frames overlapping that region then caused a panic while processing the
stream.
A remote peer can trigger this with five small STREAM frames (two of them zero-length) once the application has put the stream in unordered-read mode. The default ordered read path is not affected.
The flaw was corrected in 0.11.18 by ignoring empty ranges in RangeSet::replace.
Thanks to Otto Hermann (@ojhermann) for reporting this issue.
- Record
RUSTSEC-2026-0338- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.