{"id":"CVE-2026-31812","aliases":["DEBIAN-CVE-2026-31812","EUVD-2026-10908","GHSA-6xvm-j4wr-6v98","RUSTSEC-2026-0037","SUSE-RU-2026:1001-1","SUSE-SU-2026:1337-1","SUSE-SU-2026:1415-1","SUSE-SU-2026:21357-1","SUSE-SU-2026:22005-1","UBUNTU-CVE-2026-31812","openSUSE-SU-2026:10380-1","openSUSE-SU-2026:10382-1","openSUSE-SU-2026:10383-1","openSUSE-SU-2026:10384-1","openSUSE-SU-2026:20569-1","openSUSE-SU-2026:20865-1"],"status":"published","title":"Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing","description":"Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Prior to 0.11.14, a remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication. This vulnerability is fixed in 0.11.14.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00574,"percentile":0.47892,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-248"],"published":"2026-03-09T12:00:00Z","modified":"2026-10-28T02:30:34Z","fixes":[{"ecosystem":"crates.io","package":"quinn-proto","fixed_in":["0.11.14"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"rust-quinn-proto","fixed_in":["0.11.14-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"rust","fixed_in":["1.94.0-150500.27.65.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"rust1.94","fixed_in":["1.94.0-150300.7.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"rust","fixed_in":["1.94.0-150400.24.71.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"rust1.94","fixed_in":["1.94.0-150300.7.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"rust","fixed_in":["1.94.0-150400.24.71.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"rust1.94","fixed_in":["1.94.0-150300.7.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"rust","fixed_in":["1.94.0-150500.27.65.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"rust1.94","fixed_in":["1.94.0-150300.7.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"rust","fixed_in":["1.94.0-150500.27.65.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"rust1.94","fixed_in":["1.94.0-150300.7.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"rust","fixed_in":["1.94.0-150400.24.71.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"rust1.94","fixed_in":["1.94.0-150300.7.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"rust","fixed_in":["1.94.0-150500.27.65.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"rust1.94","fixed_in":["1.94.0-150300.7.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"rust","fixed_in":["1.94.0-150500.27.65.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"rust1.94","fixed_in":["1.94.0-150300.7.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"rust","fixed_in":["1.94.0-150400.24.71.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"rust1.94","fixed_in":["1.94.0-150300.7.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"rust","fixed_in":["1.94.0-150500.27.65.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"rust1.94","fixed_in":["1.94.0-150300.7.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"rust","fixed_in":["1.94.0-150500.27.65.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"rust1.94","fixed_in":["1.94.0-150300.7.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"rust","fixed_in":["1.94.0-150500.27.65.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"rust1.94","fixed_in":["1.94.0-150300.7.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"rust1.92","fixed_in":["1.92.0-150300.7.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"rust1.92","fixed_in":["1.92.0-150300.7.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"rust1.93","fixed_in":["1.93.0-150300.7.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"rust1.93","fixed_in":["1.93.0-150300.7.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-uv","fixed_in":["0.10.11-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"rust1.92","fixed_in":["1.92.0-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"rust1.93","fixed_in":["1.93.0-3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"rust1.94","fixed_in":["1.94.0-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"rust1.94","fixed_in":["1.94.1-160000.1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"quinn-proto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.14"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rust-quinn-proto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.2-1","0.10.5-1","0.10.5-2","0.10.6-1","0.11.13-1","0.11.14-1","0.11.16-1","0.11.9-1","0.11.9-2","0.11.9-3","0.9.2-2"]},{"source":"osv","ecosystem":"Debian:13","package":"rust-quinn-proto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.13-1","0.11.14-1","0.11.16-1","0.11.9-1","0.11.9-2","0.11.9-3"]},{"source":"osv","ecosystem":"Debian:14","package":"rust-quinn-proto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.14-1"}]}],"versions":["0.11.13-1","0.11.9-1","0.11.9-2","0.11.9-3"]},{"source":"osv","ecosystem":"crates.io","package":"quinn-proto","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.11.14"}]}]},{"source":"osv","ecosystem":"crates.io","package":"quinn-proto","ranges":[{"type":"SEMVER","events":[{"introduced":"0.5.0"},{"fixed":"0.11.14"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.94.0-150500.27.65.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"rust1.94","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.94.0-150300.7.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.94.0-150400.24.71.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"rust1.94","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.94.0-150300.7.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.94.0-150400.24.71.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"rust1.94","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.94.0-150300.7.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.94.0-150500.27.65.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"rust1.94","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.94.0-150300.7.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.94.0-150500.27.65.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"rust1.94","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.94.0-150300.7.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.94.0-150400.24.71.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"rust1.94","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.94.0-150300.7.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.94.0-150500.27.65.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"rust1.94","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.94.0-150300.7.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.94.0-150500.27.65.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"rust1.94","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.94.0-150300.7.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.94.0-150400.24.71.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"rust1.94","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.94.0-150300.7.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.94.0-150500.27.65.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"rust1.94","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.94.0-150300.7.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.94.0-150500.27.65.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"rust1.94","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.94.0-150300.7.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.94.0-150500.27.65.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"rust1.94","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.94.0-150300.7.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"rust1.92","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.92.0-150300.7.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"rust1.92","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.92.0-150300.7.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"rust1.93","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.93.0-150300.7.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"rust1.93","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.93.0-150300.7.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-uv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.18-160000.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-uv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.18-160000.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rust-quinn-proto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.2-1","0.10.5-2","0.10.6-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rust-quinn-proto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.6-1","0.11.9-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rust-quinn-proto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.9-3","0.11.14-1","0.11.16-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rust-quinn-proto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.9-1","0.11.9-3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-uv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.11-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rust1.92","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.92.0-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rust1.93","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.93.0-3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rust1.94","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.94.0-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"rust1.94","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.94.1-160000.1.1"}]}]}],"products":[{"vendor":"quinn-rs","product":"quinn"},{"vendor":"red hat","product":"confidential compute attestation"},{"vendor":"red hat","product":"logging subsystem for red hat openshift"},{"vendor":"red hat","product":"logging subsystem for red hat openshift 6.4"},{"vendor":"red hat","product":"red hat ansible automation platform 2.6"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux ai (rhel ai) 3"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"},{"vendor":"red hat","product":"red hat openshift ai 3.3"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift update service"},{"vendor":"red hat","product":"red hat trusted artifact signer 1.3"},{"vendor":"red hat","product":"red hat trusted profile analyzer"}],"references":[{"url":"https://github.com/quinn-rs/quinn/security/advisories/GHSA-6xvm-j4wr-6v98","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-31812","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2446330","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31812.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22862","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:13545","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19712","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:5459","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://github.com/quinn-rs/quinn/pull/2559","tags":["web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0037.html","tags":["web","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31812","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6xvm-j4wr-6v98"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31812.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-31812","tags":["advisory"]},{"url":"https://github.com/quinn-rs/quinn","tags":["package"]},{"url":"https://crates.io/crates/quinn-proto","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/-2026-1001/suse-ru-20261001-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1259623","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31812","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261337-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261415-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1253321","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621357-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1261876","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622005-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1259624","tags":["report"]},{"url":"https://bugzilla.suse.com/1259966","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32766","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-31812","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-31812","tags":["report"]},{"url":"https://github.com/quinn-rs/quinn/pull/2558","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-31812","title":"Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing","description":"Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Prior to 0.11.14, a remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication. This vulnerability is fixed in 0.11.14.","status":"published","published":"2026-03-10T21:04:36.812Z","modified":"2026-08-25T12:05:46.656Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-248","CWE-248"],"updated_at":"2026-11-02T14:19:50.92611Z"}],"euvd":[{"id":"EUVD-2026-10908","description":"Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Prior to 0.11.14, a remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication. This vulnerability is fixed in 0.11.14.","status":"published","published":"2026-03-10T21:04:36Z","modified":"2026-08-25T12:05:46Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:01:33.385611Z"}],"ghsa":[{"id":"GHSA-6xvm-j4wr-6v98","title":"Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing","description":"### Summary\nA remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable `quinn` versions by sending a crafted QUIC Initial packet containing malformed `quic_transport_parameters`. `In quinn-proto` parsing logic, attacker-controlled varints are decoded with `unwrap()`, so truncated encodings cause `Err(UnexpectedEnd)` and `panic`. This is reachable over the network with a single packet and no prior trust or authentication.\n\n### Details\nThe issue is panic-on-untrusted-input in QUIC transport parameter parsing.\nIn `quinn-proto` (observed in `quinn-proto 0.11.13`), parsing of some transport parameters uses a fallible varint decode followed by `unwrap()`. For malformed/truncated parameter values, decode returns `UnexpectedEnd`, and `unwrap()` panics.\n\n#### Observed output:\n```\nthread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:\ncalled `Result::unwrap()` on an `Err` value: UnexpectedEnd\n```\n\n### PoC\n#### Reproduces against the upstream Quinn server example.\n1. Start server:\n```\ncargo run --example server -- ./\n```\n2. Prepare PoC client environment:\n```\npython3 -m venv .venv\nsource .venv/bin/activate\npip install aioquic\n```\n3. Run PoC script [attack.py](https://github.com/user-attachments/files/25741713/attack.py) against server QUIC listener (default example target shown):\n```\npython attack.py\n```\n#### Observed output\n```\nthread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:\ncalled `Result::unwrap()` on an `Err` value: UnexpectedEnd\n```\n\n\n\n### Impact\nVulnerability type: Remote Denial of Service (panic/crash)\nAttack requirements:  Network reachability to UDP QUIC listener\nAuthentication/privileges: None\nWho is impacted: Any server/application using affected `quinn/quinn-proto` versions where this parse path is reachable; process-level impact depends on integration panic handling policy\n\n\nThis vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program","status":"published","published":"2026-03-11T00:09:19Z","modified":"2026-03-11T05:46:02Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T14:39:34.616253Z"}],"nvd":[{"id":"CVE-2026-31812","description":"Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Prior to 0.11.14, a remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication. This vulnerability is fixed in 0.11.14.","status":"published","published":"2026-03-10T22:16:18.84Z","modified":"2026-08-25T13:18:17.813Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T14:12:08.98071Z"}],"osv":[{"id":"CVE-2026-31812","title":"Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing","description":"Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Prior to 0.11.14, a remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication. This vulnerability is fixed in 0.11.14.","status":"published","published":"2026-03-10T21:04:36.812Z","modified":"2026-10-28T02:30:34.018727894Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T15:45:01.218144Z"},{"id":"DEBIAN-CVE-2026-31812","description":"Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Prior to 0.11.14, a remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication. This vulnerability is fixed in 0.11.14.","status":"published","published":"2026-03-10T22:16:18.84Z","modified":"2026-10-01T03:03:03.885246313Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:45:54.232518Z"},{"id":"GHSA-6xvm-j4wr-6v98","title":"Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing","description":"### Summary\nA remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable `quinn` versions by sending a crafted QUIC Initial packet containing malformed `quic_transport_parameters`. `In quinn-proto` parsing logic, attacker-controlled varints are decoded with `unwrap()`, so truncated encodings cause `Err(UnexpectedEnd)` and `panic`. This is reachable over the network with a single packet and no prior trust or authentication.\n\n### Details\nThe issue is panic-on-untrusted-input in QUIC transport parameter parsing.\nIn `quinn-proto` (observed in `quinn-proto 0.11.13`), parsing of some transport parameters uses a fallible varint decode followed by `unwrap()`. For malformed/truncated parameter values, decode returns `UnexpectedEnd`, and `unwrap()` panics.\n\n#### Observed output:\n```\nthread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:\ncalled `Result::unwrap()` on an `Err` value: UnexpectedEnd\n```\n\n### PoC\n#### Reproduces against the upstream Quinn server example.\n1. Start server:\n```\ncargo run --example server -- ./\n```\n2. Prepare PoC client environment:\n```\npython3 -m venv .venv\nsource .venv/bin/activate\npip install aioquic\n```\n3. Run PoC script [attack.py](https://github.com/user-attachments/files/25741713/attack.py) against server QUIC listener (default example target shown):\n```\npython attack.py\n```\n#### Observed output\n```\nthread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:\ncalled `Result::unwrap()` on an `Err` value: UnexpectedEnd\n```\n\n\n\n### Impact\nVulnerability type: Remote Denial of Service (panic/crash)\nAttack requirements:  Network reachability to UDP QUIC listener\nAuthentication/privileges: None\nWho is impacted: Any server/application using affected `quinn/quinn-proto` versions where this parse path is reachable; process-level impact depends on integration panic handling policy\n\n\nThis vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program","status":"published","published":"2026-03-11T00:09:19Z","modified":"2026-09-10T03:50:37.796449419Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T15:46:40.308826Z"},{"id":"RUSTSEC-2026-0037","title":"Denial of service in Quinn endpoints","description":"Receiving QUIC transport parameters containing invalid values could lead to a panic.\n\nUnfortunately the maintainers did not properly assess usage of `unwrap()` calls in the\ntransport parameters parsing code, and we did not have sufficient fuzzing coverage to find this\nissue. We have since added a fuzzing target to cover this code path.","status":"published","published":"2026-03-09T12:00:00Z","modified":"2026-03-14T07:30:14.675976Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:53:40.430679Z"},{"id":"UBUNTU-CVE-2026-31812","description":"Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Prior to 0.11.14, a remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication. This vulnerability is fixed in 0.11.14.","status":"published","published":"2026-03-10T22:16:00Z","modified":"2026-10-17T12:58:09.040959766Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:56:11.640778Z"},{"id":"openSUSE-SU-2026:10380-1","title":"python311-uv-0.10.11-1.1 on GA media","description":"These are all security issues fixed in the python311-uv-0.10.11-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-17T00:00:00Z","modified":"2026-03-18T08:45:43.382439Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:10382-1","title":"cargo1.92-1.92.0-2.1 on GA media","description":"These are all security issues fixed in the cargo1.92-1.92.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-17T00:00:00Z","modified":"2026-03-18T08:45:31.646598Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:10383-1","title":"cargo1.93-1.93.0-3.1 on GA media","description":"These are all security issues fixed in the cargo1.93-1.93.0-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-17T00:00:00Z","modified":"2026-03-18T08:45:16.640919Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:10384-1","title":"cargo1.94-1.94.0-2.1 on GA media","description":"These are all security issues fixed in the cargo1.94-1.94.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-17T00:00:00Z","modified":"2026-03-18T08:45:20.288057Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20569-1","title":"Security update for rust1.94","description":"This update for rust1.94 fixes the following issues:\n\nChanges in rust1.94:\n\n- Don't force gcc-15 on SLE-16 and higher (bsc#1261876)\n\nUpdate to rust1.94.1:\n\n- Release notes can be found externally: https://github.com/rust-lang/rust/releases/tag/1.94.1\n\n- Avoid unwrapping varint decoding during parameters parsing\n  (bsc#1259623 CVE-2026-31812).\n\n- Release notes can be found externally: https://github.com/rust-lang/rust/releases/tag/1.94.0\n","status":"published","published":"2026-04-20T14:46:54Z","modified":"2026-04-22T18:27:06.264144Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:20865-1","title":"Security update for python-uv","description":"This update for python-uv fixes the following issues:\n\n- CVE-2026-31812: quinn-proto: denial of service via crafted QUIC initial packet (bsc#1259624).\n- CVE-2026-32766: astral-tokio-tar: malformed PAX extensions can lead to archive misinterpretation (bsc#1259966).\n","status":"published","published":"2026-06-01T15:03:55Z","modified":"2026-06-04T18:24:27.457193418Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-RU-2026:1001-1","title":"Recommended update for rust1.94","description":"This update for rust1.94 fixes the following issues:\n\nThis update adds rust1.94.\n\nRelease notes can be found externally: https://github.com/rust-lang/rust/releases/tag/1.94.0\n\n- CVE-2026-31812:  avoid unwrapping varint decoding during parameters parsing (bsc#1259623)\n","status":"published","published":"2026-03-25T08:36:36Z","modified":"2026-03-26T09:02:32.995283Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2026:1337-1","title":"Security update for rust1.92","description":"This update for rust1.92 fixes the following issues:\n\n- CVE-2026-31812: Denial of service via crafted QUIC initial packet (bsc#1259623).\n","status":"published","published":"2026-04-15T07:33:26Z","modified":"2026-04-16T08:30:59.935263Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:1415-1","title":"Security update for rust1.93","description":"This update for rust1.93 fixes the following issues:\n\nSecurity issue:\n\n- CVE-2026-31812: denial of service via crafted QUIC initial packet (bsc#1259623).\n\nNon security issue:\n\n- Resolve missing gcc requirement that may affect some crate buildin (bsc#1253321).\n","status":"published","published":"2026-04-16T15:05:13Z","modified":"2026-04-17T09:01:40.475824Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:21357-1","title":"Security update for rust1.94","description":"This update for rust1.94 fixes the following issues:\n\nChanges in rust1.94:\n\n- Don't force gcc-15 on SLE-16 and higher (bsc#1261876)\n\nUpdate to rust1.94.1:\n\n- Release notes can be found externally: https://github.com/rust-lang/rust/releases/tag/1.94.1\n\n- Avoid unwrapping varint decoding during parameters parsing\n  (bsc#1259623 CVE-2026-31812).\n\n- Release notes can be found externally: https://github.com/rust-lang/rust/releases/tag/1.94.0\n","status":"published","published":"2026-04-20T15:04:21Z","modified":"2026-04-29T18:23:57.303658Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"SUSE-SU-2026:22005-1","title":"Security update for python-uv","description":"This update for python-uv fixes the following issues:\n\n- CVE-2026-31812: quinn-proto: denial of service via crafted QUIC initial packet (bsc#1259624).\n- CVE-2026-32766: astral-tokio-tar: malformed PAX extensions can lead to archive misinterpretation (bsc#1259966).\n","status":"published","published":"2026-06-01T15:05:25Z","modified":"2026-06-09T18:24:27.417007029Z","updated_at":"2026-11-02T15:54:02.654057Z"}]}}