{"id":"CVE-2026-25800","aliases":["DEBIAN-CVE-2026-25800","EUVD-2026-48374","GHSA-4w2j-m93h-cj5j","RUSTSEC-2026-0185","UBUNTU-CVE-2026-25800","openSUSE-SU-2026:11635-1","openSUSE-SU-2026:11662-1","openSUSE-SU-2026:21870-1"],"status":"published","title":"quinn-proto has remote memory exhaustion from unbounded out-of-order stream reassembly","description":"Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and prior to version 0.11.15, the `Assembler` component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a `RecvStream` in order (through an `AsyncRead` impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion. Version 0.11.15 fixes the issue.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00841,"percentile":0.5832,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2026-06-22T12:00:00Z","modified":"2026-10-28T02:31:12Z","fixes":[{"ecosystem":"crates.io","package":"quinn-proto","fixed_in":["0.11.15"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"rust-quinn-proto","fixed_in":["0.11.16-1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-uv","fixed_in":["0.12.7-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"openai-codex","fixed_in":["0.152.0-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"openai-codex","fixed_in":["0.154.0-bp160.1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"quinn-proto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.0"},{"fixed":"0.11.15"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rust-quinn-proto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.2-1","0.10.5-1","0.10.5-2","0.10.6-1","0.11.13-1","0.11.14-1","0.11.16-1","0.11.19-1","0.11.9-1","0.11.9-2","0.11.9-3","0.9.2-2"]},{"source":"osv","ecosystem":"Debian:13","package":"rust-quinn-proto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.13-1","0.11.14-1","0.11.16-1","0.11.19-1","0.11.9-1","0.11.9-2","0.11.9-3"]},{"source":"osv","ecosystem":"Debian:14","package":"rust-quinn-proto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.16-1"}]}],"versions":["0.11.13-1","0.11.14-1","0.11.9-1","0.11.9-2","0.11.9-3"]},{"source":"osv","ecosystem":"crates.io","package":"quinn-proto","ranges":[{"type":"SEMVER","events":[{"introduced":"0.1.0"},{"fixed":"0.11.15"}]}]},{"source":"osv","ecosystem":"crates.io","package":"quinn-proto","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.11.15"}]}]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rust-quinn-proto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.2-1","0.10.5-2","0.10.6-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rust-quinn-proto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.9-3","0.11.14-1","0.11.16-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rust-quinn-proto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.9-1","0.11.9-3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-uv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.7-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"openai-codex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.152.0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"openai-codex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.154.0-bp160.1.1"}]}]}],"products":[{"vendor":"quinn-rs","product":"quinn"}],"references":[{"url":"https://github.com/quinn-rs/quinn/security/advisories/GHSA-4w2j-m93h-cj5j","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/quinn-rs/quinn/pull/2694","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0185.html","tags":["x_refsource_MISC","advisory","web","report"]},{"url":"https://github.com/quinn-rs/quinn/commit/fed0321a9a672819662caab37f5662f1ad91308e","tags":["web"]},{"url":"https://github.com/quinn-rs/quinn/releases/tag/quinn-proto-0.11.15","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4w2j-m93h-cj5j"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25800.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25800","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-25800","tags":["advisory"]},{"url":"https://github.com/quinn-rs/quinn","tags":["package"]},{"url":"https://crates.io/crates/quinn-proto","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-25800","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-25800","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25800","tags":["web"]},{"url":"https://bugzilla.suse.com/1273366","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-25800","title":"quinn-proto has remote memory exhaustion from unbounded out-of-order stream reassembly","description":"Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and prior to version 0.11.15, the `Assembler` component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a `RecvStream` in order (through an `AsyncRead` impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion. Version 0.11.15 fixes the issue.","status":"published","published":"2026-07-23T19:09:19.159Z","modified":"2026-07-23T19:37:11.3Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T13:41:30.911526Z"}],"euvd":[{"id":"EUVD-2026-48374","description":"Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and prior to version 0.11.15, the `Assembler` component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a `RecvStream` in order (through an `AsyncRead` impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion. Version 0.11.15 fixes the issue.","status":"published","published":"2026-07-23T19:09:19Z","modified":"2026-07-23T19:37:11Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:19:41.632414Z"}],"ghsa":[{"id":"GHSA-4w2j-m93h-cj5j","title":"Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly","description":"## Summary\n\nThe `Assembler` component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a `RecvStream` in order (through an `AsyncRead` impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.","status":"published","published":"2026-07-24T14:07:54Z","modified":"2026-07-24T14:07:54Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:40:52.46233Z"}],"nvd":[{"id":"CVE-2026-25800","description":"Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and prior to version 0.11.15, the `Assembler` component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a `RecvStream` in order (through an `AsyncRead` impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion. Version 0.11.15 fixes the issue.","status":"published","published":"2026-07-23T20:17:07.86Z","modified":"2026-10-24T13:10:00.147Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:12:32.473901Z"}],"osv":[{"id":"CVE-2026-25800","title":"quinn-proto has remote memory exhaustion from unbounded out-of-order stream reassembly","description":"Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and prior to version 0.11.15, the `Assembler` component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a `RecvStream` in order (through an `AsyncRead` impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion. Version 0.11.15 fixes the issue.","status":"published","published":"2026-07-23T19:09:19.159Z","modified":"2026-10-28T02:31:12.088506847Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:44:59.80315Z"},{"id":"DEBIAN-CVE-2026-25800","description":"Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and prior to version 0.11.15, the `Assembler` component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a `RecvStream` in order (through an `AsyncRead` impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion. Version 0.11.15 fixes the issue.","status":"published","published":"2026-07-23T20:17:07.86Z","modified":"2026-10-25T10:00:53.925786953Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:53.877573Z"},{"id":"GHSA-4w2j-m93h-cj5j","title":"Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly","description":"## Summary\n\nThe `Assembler` component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a `RecvStream` in order (through an `AsyncRead` impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion.","status":"published","published":"2026-07-24T14:07:54Z","modified":"2026-09-10T03:51:10.288925502Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:37.528068Z"},{"id":"RUSTSEC-2026-0185","title":" Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly","description":"The `Assembler` component that assembles unordered stream fragments into consecutive chunks of the\nstream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in\norder (through an `AsyncRead` impl for example) will be sensitive to peers that send fragments\nwhile leaving out early parts of the stream, and in particular, fragments with many gaps (because\nthese cannot be defragmented). In such a scenario, the receiving connection suffers from high\nbuffer overhead, enabling memory exhaustion.","status":"published","published":"2026-06-22T12:00:00Z","modified":"2026-10-12T18:27:06.855127585Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:40.430679Z"},{"id":"UBUNTU-CVE-2026-25800","description":"Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and prior to version 0.11.15, the `Assembler` component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a `RecvStream` in order (through an `AsyncRead` impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion. Version 0.11.15 fixes the issue.","status":"published","published":"2026-07-23T20:17:00Z","modified":"2026-10-17T12:58:47.793410773Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:08.726452Z"},{"id":"openSUSE-SU-2026:11635-1","title":"python313-uv-0.12.7-1.1 on GA media","description":"These are all security issues fixed in the python313-uv-0.12.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-28T00:00:00Z","modified":"2026-08-29T09:15:04.360238515Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11662-1","title":"openai-codex-0.152.0-1.1 on GA media","description":"These are all security issues fixed in the openai-codex-0.152.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-01T00:00:00Z","modified":"2026-09-02T11:15:03.86497703Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21870-1","title":"Security update for openai-codex","description":"This update for openai-codex fixes the following issues:\n\nChanges in openai-codex:\n\nUpdate to version 0.154.0:\n\n  * Experimental worktree support for isolated checkouts of new\n    or forked sessions, with browse and resume\n  * Answer questions inline while Codex keeps working, keeping\n    the main draft\n  * Vim R replace mode with undo and dot-repeat; /copy keeps\n    formatting and covers status and session fields\n  * Plugin tools refresh after external upgrades, MCP OAuth\n    refresh is coordinated, helpers no longer run before trust\n    is established; resume and fork keep saved permissions\n  * Drop the deprecated codex mcp-server entry point, now codex mcp\n- Regenerate vendor.tar.zst: rmcp 3.1.3 -\u003e 3.2.0 plus routine\n  bumps; webrtc/gstreamer/cpal stay out of the codex-cli link\n  graph, so the License tag is unchanged\n- Legal-Review-Notice: linked-crate count 876/878 -\u003e 880/882 on\n  aarch64/x86_64; the vendored dependency licence set is unchanged\n- cargo-audit reports the same five advisories as 0.151.0, none\n  new and none fixable by re-vendoring\n\nUpdate to version 0.153.4:\n\n  * GPT-6-Astra is listed in the bundled model picker and is the\n    bundled default when no model is configured\n  * Astra's async-question guidance now applies only when\n    request_user_input_async is available in the session\n\nUpdate to version 0.153.3:\n\n  * GPT-6-Astra is available in the Amazon Bedrock model picker\n    for Mantle and Runtime global/US routes\n  * Astra's async-question guidance now names\n    request_user_input_async and notes that it accepts text only\n\n- Keep vendor.tar.zst: 0.153.4 has the same Cargo.lock as 0.153.2,\n  so the linked crate set, the License tag and the\n  Legal-Review-Notice counts are unchanged\n\n- Update to version 0.153.2:\n\n  * Correct the GPT-6-Astra Fast tier description to \"2x speed\"\n    instead of \"1.5x\"; display text only, request handling is\n    unchanged\n    \n- Update to version 0.153.1:\n\n  * GPT-6-Astra can be configured through the API without changing\n    the default model or listing it in the model picker\n    \n- Build against the system bzip2, libzstd, oniguruma and sqlite\n  instead of the copies bzip2-sys, zstd-sys, onig_sys and\n  libsqlite3-sys otherwise compile in; drop their bundled()\n  Provides and add pkgconfig(bzip2), pkgconfig(libzstd),\n  pkgconfig(oniguruma) \u003e= 6.9.3 and pkgconfig(sqlite3) \u003e= 3.34.1\n  * oniguruma and sqlite have no usable manifest switch, so %build\n    and %check export RUSTONIG_SYSTEM_LIBONIG and\n    LIBSQLITE3_SYS_USE_PKG_CONFIG instead, and %install now fails\n    the build unless all four are DT_NEEDED of codex\n  * aws-lc stays bundled: aws-lc-sys has no system-library mode\n  \n- Keep vendor.tar.zst: 0.153.2 has the same Cargo.lock as 0.153.0,\n  so the linked crate set, the License tag and the\n  Legal-Review-Notice counts are unchanged\n\n- Update to version 0.153.0:\n\n  * Vim mode gains undo (u) and redo (Ctrl+R), preserving whole\n    drafts including pasted content and attachments\n  * The plugin CLI lists, installs and removes plugins from remote\n    marketplaces\n  * tui.auto_recap = false turns off automatic recaps while keeping\n    /recap available\n  * TUI history shows complete patches, input sent to background\n    terminals and individual completed commands\n  * TUI sessions reconnect after an app-server connection drops,\n    keeping drafts and holding queued submissions for review\n  * Guardian review history survives compaction, restarts and\n    forks; Full Access skips Guardian review for confirmation-only\n    actions\n  * Remembered MCP tool approvals are scoped to the selected\n    app account\n  * tui.disable_paste_burst replaces the top-level setting, which\n    stays supported as a fallback\n  * New disabled-by-default\n    features.context_management.experimental_mode\n    \n- Regenerate vendor.tar.zst: the 14 crates 0.153.0 adds to the\n  lockfile are all Windows-only, so the linked third-party set,\n  the License tag and the bundled() versions are unchanged; the\n  Legal-Review-Notice counts move only by one added first-party\n  workspace member\n\n- Update to version 0.152.1:\n\n  * Guardian approval review honours Node REPL policies supplied\n    through model metadata; the bundled policy is now only the\n    fallback\n  * Switching models mid-session is refused when the destination\n    changes the Guardian parent-fallback node REPL policy\n\n- Update to version 0.152.0:\n\n  * Vim mode gains \"/\" and \"?\" search within drafts, with match\n    highlighting and n/N repeat navigation\n  * Rate-limit banners offer actions for checking usage, managing\n    credits, resetting limits and managing plans\n  * TUI and \"codex exec\" show credential-refresh progress,\n    including Amazon Bedrock reauthentication\n  * MCP server names may contain \":\", \"@\", \"/\" and \".\"\n  * Individual MCP tools honour an output_token_limit setting\n  * App-server clients can configure thread/shellCommand timeouts\n    longer than one hour\n  * Cloud task requests reject untrusted backend URLs and refuse\n    redirects, protecting saved credentials\n  * The planning tool is now disabled by default; re-enable with\n    tools.update_plan.enabled = true\n  * Vim-enabled composers start fresh drafts in Insert mode again\n  \n- cargo-audit reports five advisories on the vendored lockfile, all\n  pre-existing and unchanged since 0.151.0; audit a bare Cargo.lock\n  because upstream's codex-rs/.cargo/audit.toml hides four of them:\n  \n  * CVE-2026-25800 (RUSTSEC-2026-0185, quinn-proto 0.11.14): not\n    affected, reqwest gates dep:quinn behind its \"http3\" feature,\n    which the workspace leaves off, so it is never linked\n  * RUSTSEC-2026-0194 and -0195 (quick-xml 0.39.4) and\n    RUSTSEC-2026-0118 and -0119 (hickory-proto 0.25.2), DoS with no\n    CVE assigned: linked, but each fix is a semver-incompatible\n    bump of an intermediate crate, or not released at all\n    \n- Legal-Review-Notice: linked-crate count 874/876 -\u003e 875/877 on\n  aarch64/x86_64, from one new first-party workspace crate\n  (codex-guardian-context). The vendored dependency set, the\n  bundled() versions and the License tag are unchanged from 0.151.0\n\n- Update to version 0.151.0:\n\n  * Configurable grace period for discovering tools from optional\n    MCP servers\n  * Extensions can inspect or replace MCP tool results before they\n    reach the model\n  * Plugin catalogs combine per-repository configuration and report\n    invalid project marketplaces without hiding valid plugins\n  * Preserve restored permission profiles across TUI turns; /cd can\n    no longer weaken sandbox restrictions\n  * Stale Guardian classifications no longer authorize actions after\n    a permission-state change\n  * Remote sandbox enforcement uses the executor's actual home\n    directory, OS and path conventions\n  * Keep tool availability and reasoning effort correct when\n    switching models or falling back to another one\n  * Nested subagent token usage counts toward root goal budgets\n  \n- Vendored dependency set is unchanged from 0.150.1 (1193 crates,\n  none added or removed), so the License tally and the bundled()\n  versions still hold.\n","status":"published","published":"2026-09-16T20:01:13Z","modified":"2026-09-17T18:23:14.842202658Z","updated_at":"2026-11-02T16:58:42.426393Z"}]}}